---METADATA---
VENDOR: TUBITAK BILGEM Software Technologies Research Institute
PRODUCT: Liderahenk
AFFECTED_VERSIONS: 2.0.1
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Liderahenk contains an origin validation error that allows unauthenticated access to restricted application functionality by bypassing configured Access Control Lists (ACLs).

Executive Summary:
A critical origin validation error in Liderahenk allows unauthorized access to sensitive functionality, posing a severe risk of complete system compromise.

Vulnerability Details

CVE-ID: CVE-2026-6508

Affected Software: TUBITAK BILGEM Software Technologies Research Institute Liderahenk

Affected Versions: 2.0.1

Vulnerability: This vulnerability stems from a failure to properly validate the origin of requests, allowing an unauthenticated attacker to bypass established ACLs. This effectively grants access to administrative or restricted functions that should otherwise be protected.

Business Impact

The CVSS score of 9.8 indicates a critical risk to the confidentiality, integrity, and availability of the Liderahenk platform. Exploitation could allow an attacker to perform unauthorized administrative actions, leading to full system compromise and significant data breaches.

Remediation Plan

Immediate Action: Upgrade to Liderahenk version 2.0.2 or the latest vendor-supplied patch.

Proactive Monitoring: Monitor system logs for unauthorized access attempts to restricted API endpoints or administrative functions.

Compensating Controls: Restrict network access to the Liderahenk interface using IP allow-lists and ensure it is not exposed to the public internet.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a total failure of authorization controls. Organizations utilizing Liderahenk must treat this as a high-priority remediation item and apply the necessary updates immediately to secure their environment.

---METADATA---
VENDOR: TUBITAK BILGEM
PRODUCT: Pardus Software Center
AFFECTED_VERSIONS: Before 1.0.3
---END_METADATA---

Description Summary:
A path traversal vulnerability in the Pardus Software Center allows attackers to access or manipulate files outside the intended directory.

Executive Summary:
A critical path traversal vulnerability in the Pardus Software Center allows attackers to access unauthorized files, potentially leading to system compromise.

Vulnerability Details

CVE-ID: CVE-2026-5166

Affected Software: Pardus Software Center

Affected Versions: Before 1.0.3

Vulnerability: The application fails to properly limit pathnames to a restricted directory, allowing for directory traversal attacks that can be exploited by local or remote attackers.

Business Impact

The CVSS score of 9.6 indicates a high potential for impact, including unauthorized access to sensitive system files and configuration data. This could allow an attacker to gain elevated privileges or disrupt the functionality of the software center.

Remediation Plan

Immediate Action: Upgrade the Pardus Software Center to version 1.0.3 or later.

Proactive Monitoring: Monitor system logs for file access anomalies or attempts to access unexpected directories.

Compensating Controls: Enforce strict file system permissions to ensure the software center runs with the least privilege necessary.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability should be addressed with high urgency. Users of the Pardus Software Center should verify their current version and update immediately to prevent unauthorized file access.

---METADATA---
VENDOR: ArthurFiorette
PRODUCT: steam-trader
AFFECTED_VERSIONS: 2.1.1
---END_METADATA---

Description Summary:
ArthurFiorette steam-trader 2.1.1 is vulnerable to unauthenticated sensitive information exposure, leaking Steam account credentials and 2FA secrets via API and logs.

Executive Summary:
An unauthenticated attacker can gain full control of Steam accounts by exploiting a critical information exposure vulnerability in the unmaintained steam-trader software.

Vulnerability Details

CVE-ID: CVE-2026-5128

Affected Software: ArthurFiorette steam-trader

Affected Versions: 2.1.1

Vulnerability: The /users API endpoint allows unauthenticated access to sensitive Steam account data, including passwords and identity secrets. Additionally, the application logs authentication artifacts such as access tokens and shared secrets, which can be used to generate Steam Guard (2FA) codes.

Business Impact

This vulnerability leads to the total compromise of associated Steam accounts, including inventory, trading capabilities, and personal information. With a CVSS score of 10.0, the risk is absolute. Since the repository is archived and no fix is available, any continued use of this software poses an extreme and unmitigated risk.

Remediation Plan

Immediate Action: Immediately cease all use of the ArthurFiorette steam-trader software and decommission any active instances, as no patch will be provided for this archived project.

Proactive Monitoring: If the software was used, immediately change all Steam account passwords, revoke active sessions, and reset Steam Guard/2FA secrets for all affected accounts.

Compensating Controls: There are no effective compensating controls for a software-level credential leak of this magnitude other than total removal of the software.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 30, 2026, there is no public information indicating active exploitation. However, the exposure of 2FA secrets makes this vulnerability uniquely dangerous and highly attractive to attackers.

Analyst Recommendation

The use of ArthurFiorette steam-trader 2.1.1 must be discontinued immediately. Because the project is no longer maintained and the flaw is critical, there is no path to secure use. Users must migrate to a supported alternative and perform a full security reset of their Steam credentials.

---METADATA---
VENDOR: Tenable
PRODUCT: Terrascan
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
A security vulnerability has been identified in Terrascan version 1. The specific technical details regarding the exploit vector are currently limited.

Executive Summary:
An unidentified vulnerability in Terrascan v1 poses a risk to security infrastructure, necessitating immediate review of vendor security bulletins.

Vulnerability Details

CVE-ID: CVE-2026-47358

Affected Software: Tenable Terrascan

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves Terrascan v1. The lack of detailed technical documentation prevents a definitive assessment of the authentication requirements or the specific vulnerability type.

Business Impact

A CVSS score of 7.5 indicates a High severity risk. As Terrascan is used for Infrastructure-as-Code (IaC) scanning, a compromise of this tool could lead to the misconfiguration of cloud environments or the exposure of sensitive security policies, undermining the organization's overall compliance posture.

Remediation Plan

Immediate Action: Monitor official Tenable security channels for specific patch releases and update all instances of Terrascan to the remediated version immediately upon availability.

Proactive Monitoring: Conduct audits of recent IaC scan results for anomalies and verify that no unauthorized changes have been made to security configurations during the period of exposure.

Compensating Controls: Implement strict access control for the environments where Terrascan is deployed and ensure scan results are stored in secure, restricted locations.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations utilizing Terrascan for automated security policy enforcement should treat this vulnerability as a priority. Verify the current version status and prepare for an immediate update cycle once the vendor releases technical documentation and patches.

---METADATA---
VENDOR: Tenable
PRODUCT: Terrascan
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
A security vulnerability has been identified in Terrascan version 1. The specific technical details regarding the exploit vector are currently limited.

Executive Summary:
An unidentified vulnerability in Terrascan v1 poses a risk to security infrastructure, necessitating immediate review of vendor security bulletins.

Vulnerability Details

CVE-ID: CVE-2026-47357

Affected Software: Tenable Terrascan

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves Terrascan v1. The lack of detailed technical documentation prevents a definitive assessment of the authentication requirements or the specific vulnerability type.

Business Impact

A CVSS score of 7.5 indicates a High severity risk. As Terrascan is used for Infrastructure-as-Code (IaC) scanning, a compromise of this tool could lead to the misconfiguration of cloud environments or the exposure of sensitive security policies, undermining the organization's overall compliance posture.

Remediation Plan

Immediate Action: Monitor official Tenable security channels for specific patch releases and update all instances of Terrascan to the remediated version immediately upon availability.

Proactive Monitoring: Conduct audits of recent IaC scan results for anomalies and verify that no unauthorized changes have been made to security configurations during the period of exposure.

Compensating Controls: Implement strict access control for the environments where Terrascan is deployed and ensure scan results are stored in secure, restricted locations.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations utilizing Terrascan for automated security policy enforcement should treat this vulnerability as a priority. Verify the current version status and prepare for an immediate update cycle once the vendor releases technical documentation and patches.

---METADATA---
VENDOR: Tenable
PRODUCT: Terrascan
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
A vulnerability exists in Terrascan v1 that requires immediate investigation and remediation by administrators.

Executive Summary:
A security vulnerability identified in Tenable Terrascan v1 poses a significant risk to infrastructure-as-code scanning environments.

Vulnerability Details

CVE-ID: CVE-2026-47356

Affected Software: Tenable Terrascan

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The provided data is insufficient to categorize the specific vulnerability type; however, given the CVSS score of 7.5, it represents a high-severity security flaw that could compromise scanning integrity.

Business Impact

The vulnerability carries a CVSS score of 7.5, indicating a high potential for operational disruption or unauthorized access to security scanning workflows. If exploited, attackers could manipulate security configurations, potentially allowing insecure infrastructure deployments to bypass automated governance checks.

Remediation Plan

Immediate Action: Consult the official Tenable security advisory to identify and apply the latest available version or hotfix for Terrascan.

Proactive Monitoring: Audit logs for unauthorized access to the scanning environment and track any unexpected changes to policy-as-code configurations.

Compensating Controls: Restrict access to the Terrascan management interface to authorized personnel only and ensure the service is deployed within a protected network segment.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the lack of specific technical details, administrators must prioritize reviewing vendor communications from Tenable. Apply all available security updates immediately to mitigate potential risks to your security scanning infrastructure.

---METADATA---
VENDOR: JasperFx
PRODUCT: Marten
AFFECTED_VERSIONS: < 8.36.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Marten, a .NET transactional document database, is vulnerable to SQL injection because it fails to properly parameterize the regConfig parameter in full-text search APIs.

Executive Summary:
A critical SQL injection vulnerability in the Marten .NET library allows attackers to execute arbitrary database commands via unsanitized full-text search inputs.

Vulnerability Details

CVE-ID: CVE-2026-45288

Affected Software: JasperFx Marten

Affected Versions: < 8.36.1

Vulnerability: The vulnerability stems from improper neutralization of special elements in the regConfig parameter of full-text search APIs. This allows for SQL injection when untrusted user input is passed into these functions without adequate validation.

Business Impact

With a CVSS score of 9.8, this vulnerability poses a severe risk to data integrity and confidentiality. Exploitation could allow an attacker to bypass application logic, exfiltrate sensitive data from the underlying PostgreSQL database, or cause significant system disruption.

Remediation Plan

Immediate Action: Upgrade the JasperFx Marten library to version 8.36.1 or later to ensure the regConfig parameter is properly parameterized.

Proactive Monitoring: Inspect application logs for anomalous database queries or unexpected syntax errors originating from search functionality. Monitor PostgreSQL server logs for unusual query patterns.

Compensating Controls: Utilize input validation and sanitization routines at the application layer to block malicious payloads from reaching the database driver.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 28, 2026, there is no public information indicating active exploitation of this vulnerability. However, the ease of exploitation in SQL injection flaws necessitates immediate patching.

Analyst Recommendation

This vulnerability represents a significant risk to any application utilizing the affected versions of Marten. Development teams must prioritize the transition to version 8.36.1 to eliminate the SQL injection vector and protect the underlying database infrastructure.

---METADATA---
VENDOR: WebPros
PRODUCT: Plesk
AFFECTED_VERSIONS: 18.0.75.1, 18.0.76.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Plesk contains an XPath injection vulnerability in the APS Application Catalog, allowing authenticated users to execute arbitrary OS commands as a low-privileged user.

Executive Summary:
An authenticated XPath injection vulnerability in the Plesk APS Application Catalog enables command execution and local privilege escalation.

Vulnerability Details

CVE-ID: CVE-2026-44962

Affected Software: WebPros Plesk

Affected Versions: 18.0.75.1, 18.0.76.2

Vulnerability: The application fails to properly sanitize user-supplied input before passing it into XPath queries (CWE-643). An authenticated, low-privileged user can exploit this to perform XPath injection, leading to arbitrary command execution on the underlying server.

Business Impact

With a CVSS score of 9.9, this vulnerability poses a critical risk to hosting environments. Successful exploitation allows an authenticated attacker to escalate privileges, potentially leading to a full server compromise, unauthorized access to hosted data, and disruption of all services managed by the Plesk instance.

Remediation Plan

Immediate Action: Upgrade to the latest patched version of Plesk as specified in the vendor security advisory.

Proactive Monitoring: Audit server logs for suspicious command execution patterns or abnormal XPath query strings originating from the APS Application Catalog search functionality.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter and block requests containing malicious XPath injection payloads directed at the catalog search.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability for a low-privileged user to achieve command execution makes this a high-priority update. Organizations should apply the vendor-provided patches immediately to prevent privilege escalation and maintain the integrity of the hosting server.

---METADATA---
VENDOR: Linkwarden
PRODUCT: Linkwarden
AFFECTED_VERSIONS: Prior to 2.13.0
---END_METADATA---

Description Summary:
A Server-Side Request Forgery (SSRF) vulnerability in Linkwarden allows authenticated users to make unauthorized requests to internal services via insufficient URL validation.

Executive Summary:
An SSRF vulnerability in Linkwarden allows authenticated users to probe internal network services, potentially leading to unauthorized data access or service disruption.

Vulnerability Details

CVE-ID: CVE-2026-44313

Affected Software: Linkwarden Linkwarden

Affected Versions: Prior to 2.13.0

Vulnerability: The fetchTitleAndHeaders function contains an SSRF flaw due to inadequate URL validation. Authenticated users can bypass checks that only verify the "http://" or "https://" prefix to query internal, non-public services.

Business Impact

With a CVSS score of 9.1, this vulnerability poses a significant risk to the internal network infrastructure. An attacker can leverage this SSRF to scan internal ports, interact with internal APIs, or access metadata services, potentially leading to further compromise of the internal environment.

Remediation Plan

Immediate Action: Update Linkwarden to version 2.13.0 or later to implement strict URL validation.

Proactive Monitoring: Monitor network logs for outbound requests originating from the Linkwarden server directed at internal IP ranges or sensitive internal services.

Compensating Controls: Implement network segmentation to isolate the Linkwarden instance and restrict its ability to communicate with internal, non-public resources.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

SSRF vulnerabilities are often used as a stepping stone for deeper network penetration. Organizations should prioritize updating Linkwarden and ensuring that the host server follows the principle of least privilege regarding network access.

---METADATA---
VENDOR: Arch
PRODUCT: apko
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability exists in the apko tool, which is used for building OCI container images from apk packages.

Executive Summary:
A security flaw in the apko tool could impact the integrity of container image builds, posing a risk to the software supply chain.

Vulnerability Details

CVE-ID: CVE-2026-42574

Affected Software: Arch apko

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves issues within the build logic of apko, potentially allowing for the manipulation of container build processes.

Business Impact

As a tool for creating container images, apko is a critical part of the modern development pipeline. A CVSS score of 7.5 indicates that this is a significant issue; malicious actors could leverage this to distribute compromised images, leading to broad security impacts across production environments.

Remediation Plan

Immediate Action: Update the apko tooling in all development and CI/CD environments to the latest patched version.

Proactive Monitoring: Implement robust container image scanning and signature verification to ensure the integrity of images built with apko.

Compensating Controls: Enforce strict access control on build environments and utilize ephemeral runners to minimize persistence opportunities for attackers.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Teams utilizing apko for container image creation must prioritize these updates to ensure supply chain security. Immediate patching is recommended to maintain the integrity of your build artifacts.

---METADATA---
VENDOR: Jupyter
PRODUCT: JupyterLab
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in JupyterLab, an extensible environment for interactive computing.

Executive Summary:
A critical security vulnerability in JupyterLab requires immediate attention to prevent unauthorized access to interactive computing environments.

Vulnerability Details

CVE-ID: CVE-2026-42266

Affected Software: JupyterLab

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: While specific technical details are developing, the vulnerability affects the JupyterLab environment. Such environments are frequent targets due to their ability to execute arbitrary code within the context of the user's session.

Business Impact

An exploit could allow an attacker to gain unauthorized access to an organization's data science environment, potentially exposing proprietary algorithms, sensitive datasets, or credentials stored within notebooks. The 8.8 CVSS score highlights the high-risk nature of this vulnerability.

Remediation Plan

Immediate Action: Update JupyterLab to the latest version as recommended by the vendor.

Proactive Monitoring: Monitor for anomalous notebook activity, unauthorized access to Jupyter instances, or suspicious outbound network connections from the host.

Compensating Controls: Use containerization to isolate individual JupyterLab instances and enforce strict authentication mechanisms for access to the interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should treat this update with high priority to protect sensitive research and data analytics environments. Ensuring that JupyterLab instances are updated and properly isolated is essential to mitigating this risk.

---METADATA---
VENDOR: Arch
PRODUCT: Nornicdb
AFFECTED_VERSIONS: Prior to 1.0.42-hotfix
---END_METADATA---

Description Summary:
Nornicdb fails to bind the Bolt server to the configured host, defaulting to all interfaces and exposing the database with default credentials to the network.

Executive Summary:
A configuration binding error in Nornicdb leaves the database exposed on all network interfaces with default credentials, allowing unauthenticated remote access.

Vulnerability Details

CVE-ID: CVE-2026-42072

Affected Software: Arch Nornicdb

Affected Versions: Prior to 1.0.42-hotfix

Vulnerability: The Bolt server listener ignores the user-configured address and defaults to binding on all interfaces (0.0.0.0). When combined with default admin credentials, this enables unauthenticated remote attackers on the LAN to gain full control over the graph database.

Business Impact

Exposure of a database containing sensitive graph and vector data can lead to massive data breaches and total loss of confidentiality. Because the service defaults to weak, well-known credentials, the barrier to entry for an attacker is extremely low. The 9.8 CVSS score reflects the high risk of compromise for any Nornicdb instance exposed on a network.

Remediation Plan

Immediate Action: Upgrade Nornicdb to version 1.0.42-hotfix or later and immediately change the default admin credentials.

Proactive Monitoring: Audit network traffic for unauthorized access attempts to the Nornicdb port and review database access logs for unrecognized activity.

Compensating Controls: Ensure the database is placed behind a firewall that restricts access to the management port from untrusted network segments.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The combination of insecure default configurations and network exposure makes this a critical risk. Administrators must update to 1.0.42-hotfix immediately and enforce strong password policies for all administrative accounts to mitigate the risk of unauthorized database access.

---METADATA---
VENDOR: Budibase
PRODUCT: Budibase
AFFECTED_VERSIONS: Prior to 3.35.4
---END_METADATA---

Description Summary:
Budibase contains an authentication bypass vulnerability where unanchored regular expressions allow attackers to access protected endpoints via crafted query strings.

Executive Summary:
An authentication bypass vulnerability in Budibase allows unauthenticated attackers to access restricted endpoints, posing a severe risk to data confidentiality and integrity.

Vulnerability Details

CVE-ID: CVE-2026-41428

Affected Software: Budibase

Affected Versions: Prior to 3.35.4

Vulnerability: The application utilizes unanchored regular expressions in its middleware to validate request URLs. Attackers can leverage this to bypass authentication by appending a public endpoint path as a query parameter, effectively tricking the system into granting unauthorized access.

Business Impact

With a CVSS score of 9.1, this vulnerability is critical as it allows for the complete compromise of administrative and system-level functions. Unauthorized access could lead to the exposure of sensitive platform data, modification of user accounts, or full system takeover, resulting in significant operational disruption and loss of trust.

Remediation Plan

Immediate Action: Upgrade Budibase to version 3.35.4 or later immediately to implement the corrected regex anchoring logic.

Proactive Monitoring: Review web server access logs for anomalous requests containing suspicious query parameters that mimic internal API paths.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to inspect and filter query strings for unauthorized path traversal or API endpoint manipulation patterns.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of April 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this authentication bypass cannot be overstated, as it effectively removes the primary security barrier for the platform. Administrators must prioritize the patch application in all production instances of Budibase to prevent unauthorized lateral movement and data exfiltration.

---METADATA---
VENDOR: Arch
PRODUCT: CI4MS
AFFECTED_VERSIONS: 0.31.4.0
---END_METADATA---

Description Summary:
CI4MS contains a stored DOM-based XSS vulnerability in the backup module that can be leveraged for full account takeover.

Executive Summary:
A stored DOM XSS vulnerability in CI4MS allows attackers to perform full account takeover and privilege escalation.

Vulnerability Details

CVE-ID: CVE-2026-41201

Affected Software: Arch CI4MS

Affected Versions: 0.31.4.0

Vulnerability: An attacker can upload a crafted SQL file containing a malicious filename that triggers stored DOM XSS when processed by the backup module. This allows for the execution of arbitrary JavaScript in the context of an administrator's session.

Business Impact

The ability to execute JavaScript in an administrator's browser leads directly to account takeover and full control over the CMS. Given the 9.1 CVSS score, this is a critical threat to the integrity and availability of the managed content and infrastructure.

Remediation Plan

Immediate Action: Update CI4MS to version 0.31.5.0 immediately.

Proactive Monitoring: Monitor application logs for suspicious file uploads or unusual backup module activity.

Compensating Controls: Implement strict file type and name validation on the server side and utilize a Content Security Policy (CSP) to mitigate the impact of XSS attacks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators must update to the patched version immediately. Additionally, verify that all existing backup files are clean and that no malicious payloads have already been stored.

---METADATA---
VENDOR: FreeScout
PRODUCT: FreeScout
AFFECTED_VERSIONS: Prior to 1.8.215
CONFIDENCE: high
MISSING: exploit_status
---END_METADATA---

Description Summary:
FreeScout before 1.8.215 contains an arbitrary file write vulnerability in the module installation feature due to improper validation of ZIP archive file paths.

Executive Summary:
An authenticated administrative vulnerability in FreeScout allows arbitrary file writes on the server, posing a critical risk of remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-41193

Affected Software: FreeScout

Affected Versions: Prior to 1.8.215

Vulnerability: The vulnerability exists in the module installation feature, which fails to validate file paths when extracting ZIP archives. An authenticated administrator can leverage this to write malicious files to arbitrary locations on the server filesystem.

Business Impact

With a CVSS score of 9.1, this vulnerability poses a severe threat to the underlying server infrastructure. An attacker with administrative access could achieve remote code execution, leading to full server compromise, persistent backdoors, and total loss of confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Upgrade FreeScout to version 1.8.215 or later to resolve the archive extraction flaw.

Proactive Monitoring: Inspect the server's web directories and sensitive system paths for the presence of unauthorized or unexpected files created during module installation tasks.

Compensating Controls: Restrict administrative access to the module installation interface to trusted personnel only and ensure the web server service account has minimal filesystem write permissions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant security risk for self-hosted FreeScout instances. Administrators must prioritize the update to version 1.8.215 to prevent potential remote code execution via arbitrary file writes.

---METADATA---
VENDOR: Gramps Project
PRODUCT: Gramps Web API
AFFECTED_VERSIONS: 1.6.0 through 3.11.0
CONFIDENCE: high
MISSING: exploit_status, technical_details
---END_METADATA---

Description Summary:
A path traversal vulnerability (Zip Slip) in the Gramps Web API media archive import feature allows authenticated owners to write arbitrary files to the server filesystem.

Executive Summary:
An authenticated path traversal vulnerability in Gramps Web API versions 1.6.0 through 3.11.0 poses a critical risk of arbitrary file write and potential remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-40258

Affected Software: Gramps Project Gramps Web API

Affected Versions: 1.6.0 through 3.11.0

Vulnerability: The vulnerability exists in the media archive import feature, where insufficient validation of ZIP entry paths allows an authenticated user with owner-level privileges to perform directory traversal. This permits the writing of files outside the intended temporary extraction directory.

Business Impact

The ability to write arbitrary files to the server filesystem can lead to full system compromise if an attacker overwrites sensitive configuration files or places executable scripts in accessible directories. Given the CVSS score of 9.1, this vulnerability represents a severe threat to data integrity and system availability. Unauthorized file manipulation could result in significant operational disruption and loss of confidential genealogical data.

Remediation Plan

Immediate Action: Upgrade the Gramps Web API to version 3.11.1 or later, which implements strict path validation for ZIP archives.

Proactive Monitoring: Review application and system logs for unusual file creation events or attempts to access directories outside the designated temporary storage path.

Compensating Controls: Restrict the permissions of the service account running the Web API to the minimum necessary and employ filesystem monitoring tools to detect unauthorized file writes.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of Apr 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations utilizing the Gramps Web API must prioritize updating to version 3.11.1 immediately to remediate this critical path traversal risk. Failure to apply this update leaves the underlying server susceptible to arbitrary file modification by authenticated users.

---METADATA---
VENDOR: Trilium
PRODUCT: Trilium Notes
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, exploit_status, technical_details
---END_METADATA---

Description Summary:
A security vulnerability has been identified in the Trilium Notes application, a cross-platform personal knowledge base tool.

Executive Summary:
Trilium Notes is vulnerable to a security flaw that may allow unauthorized access or data compromise within the application.

Vulnerability Details

CVE-ID: CVE-2026-39310

Affected Software: Trilium Trilium Notes

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability affects Trilium Notes, which is used for managing large personal knowledge bases. The specific technical details of the vulnerability are currently sparse, preventing a precise determination of the attack surface.

Business Impact

The CVSS score of 8.6 qualifies this as a High severity vulnerability. Successful exploitation could lead to the unauthorized disclosure of sensitive information stored within personal knowledge bases or potential system-level compromise, depending on the application's deployment environment.

Remediation Plan

Immediate Action: Apply all vendor-supplied security updates immediately upon release to ensure the application environment is secured.

Proactive Monitoring: Monitor for unusual modifications to note databases or unauthorized access attempts to the application interface.

Compensating Controls: Restrict network access to the application instance to trusted users and networks to minimize the potential attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Users of Trilium Notes should treat this vulnerability as a significant risk to their personal or organizational data. Maintain vigilance for official vendor announcements and apply updates immediately to maintain the security of stored information.

---METADATA---
VENDOR: Anviz
PRODUCT: CX2 Lite and CX7
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: versions, patch, exploit_status, technical_details
---END_METADATA---

Description Summary:
Anviz CX2 Lite and CX7 devices are vulnerable to unauthenticated firmware uploads, allowing remote attackers to plant malicious code and obtain a reverse shell.

Executive Summary:
A critical vulnerability in Anviz CX2 Lite and CX7 devices allows unauthenticated remote attackers to upload and execute malicious firmware, leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-35546

Affected Software: Anviz CX2 Lite and CX7

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The devices lack proper authentication for firmware upload processes, enabling attackers to submit crafted archives. This allows for arbitrary code execution and the establishment of a reverse shell on the affected hardware.

Business Impact

A CVSS score of 9.8 reflects the extreme risk posed by this vulnerability, as it allows for persistent, unauthenticated remote code execution. Attackers gaining control over these devices could use them as a foothold for lateral movement within the corporate network, leading to widespread data compromise and operational disruption.

Remediation Plan

Immediate Action: Update the firmware on all Anviz CX2 Lite and CX7 units to the latest version provided by the manufacturer.

Proactive Monitoring: Monitor network traffic for unusual outbound connections originating from these devices, particularly those indicative of reverse shell activity.

Compensating Controls: Isolate the devices within a segmented network and restrict administrative access to the management interfaces to trusted IP addresses only.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of Apr 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a total loss of security for the affected devices. It is imperative that security teams verify the firmware version of all deployed Anviz CX2 Lite and CX7 units and apply the necessary updates immediately to prevent unauthorized remote control.

---METADATA---
VENDOR: Bruno
PRODUCT: Bruno IDE
AFFECTED_VERSIONS: Prior to 3.2.1
---END_METADATA---

Description Summary:
A supply chain attack on the Bruno IDE introduced a malicious dependency, resulting in the deployment of a cross-platform Remote Access Trojan (RAT).

Executive Summary:
The Bruno IDE was subject to a supply chain compromise that distributed a Remote Access Trojan (RAT) to users through a malicious npm package dependency.

Vulnerability Details

CVE-ID: CVE-2026-34841

Affected Software: Bruno IDE

Affected Versions: Prior to 3.2.1

Vulnerability: This supply chain attack involved the compromise of the axios npm package. Users who performed an installation during the window of compromise inadvertently pulled in a malicious dependency that deployed a RAT, allowing for unauthorized remote access to the host system.

Business Impact

A CVSS score of 9.8 reflects the severity of a system-level compromise. The deployment of a RAT grants an attacker full persistent access to the developer's machine, enabling the theft of source code, API credentials, and internal network access, which can have catastrophic consequences for the organization.

Remediation Plan

Immediate Action: Upgrade to Bruno IDE version 3.2.1 and perform a full forensic scan of any machines that ran npm install for @usebruno/cli on March 31, 2026.

Proactive Monitoring: Monitor systems for outbound connections to unknown or suspicious command-and-control (C2) infrastructure and check for unexpected background processes.

Compensating Controls: Utilize endpoint detection and response (EDR) solutions to identify and isolate suspicious processes originating from node-based development tools.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of April 6, 2026, the vulnerability involves confirmed malicious activity via a supply chain compromise. The risk of ongoing unauthorized access on infected machines is extremely high.

Analyst Recommendation

Users and organizations who installed or updated the Bruno CLI during the impacted window must assume their systems are compromised. Immediate remediation and comprehensive incident response procedures are required to purge the malware and reset all exposed credentials.

---METADATA---
VENDOR: CI4MS
PRODUCT: CI4MS (CodeIgniter 4 CMS)
AFFECTED_VERSIONS: Prior to 0.31.0.0
---END_METADATA---

Description Summary:
A Stored Cross-Site Scripting (XSS) vulnerability in the CI4MS backend user management allows attackers to inject malicious JavaScript, leading to full administrative account compromise.

Executive Summary:
CI4MS is vulnerable to a critical stored XSS flaw in its administrative interface that allows for session hijacking and total backend takeover.

Vulnerability Details

CVE-ID: CVE-2026-34571

Affected Software: CI4MS

Affected Versions: Prior to 0.31.0.0

Vulnerability: This is a Stored XSS vulnerability located in the backend user management functionality. An authenticated attacker can inject persistent JavaScript into user-controlled fields which then executes automatically when an administrator views the affected management page.

Business Impact

A successful exploit enables attackers to hijack administrative sessions, escalate privileges, and gain full control over the CMS. Despite being an XSS flaw, the CVSS score of 9.9 is justified by the direct path to full administrative compromise and system-wide impact.

Remediation Plan

Immediate Action: Update the CI4MS skeleton and associated modules to version 0.31.0.0 or higher immediately.

Proactive Monitoring: Audit backend user accounts for unauthorized additions or modifications and review access logs for suspicious administrative session activity.

Compensating Controls: Enable Content Security Policy (CSP) headers to restrict the execution of unauthorized scripts and use a WAF to filter common XSS injection patterns.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Apr 1, 2026, no active exploitation has been reported. However, the high CVSS score reflects the ease with which an internal or compromised user could take over the entire application.

Analyst Recommendation

The ability to compromise administrative accounts via stored scripts is a critical risk. Administrators must apply the version 0.31.0.0 patch immediately to secure the backend management interface.

---METADATA---
VENDOR: CI4MS
PRODUCT: CI4MS (CodeIgniter 4 CMS)
AFFECTED_VERSIONS: Prior to 0.31.0.0
---END_METADATA---

Description Summary:
CI4MS versions prior to 0.31.0.0 are vulnerable to Stored XSS in the blog category title field, allowing malicious scripts to execute on both public and administrative pages.

Executive Summary:
A critical stored XSS vulnerability in CI4MS blog categories allows attackers to compromise both site visitors and administrative users through malicious script injection.

Vulnerability Details

CVE-ID: CVE-2026-34569

Affected Software: CI4MS

Affected Versions: Prior to 0.31.0.0

Vulnerability: The application fails to sanitize input when creating or editing blog categories. An attacker can inject a payload into the category title, which is then rendered without encoding on public blog pages and administrative views, facilitating a Stored XSS attack.

Business Impact

This vulnerability poses a dual threat: it can be used to hijack administrative sessions or to attack site visitors via drive-by downloads or credential harvesting. The CVSS score of 9.9 highlights the extreme risk of widespread session hijacking and site-wide compromise.

Remediation Plan

Immediate Action: Upgrade CI4MS to version 0.31.0.0 to implement necessary output encoding and input sanitization.

Proactive Monitoring: Scan the database for existing blog category titles containing <script> tags or other HTML event handlers.

Compensating Controls: Implement a robust Content Security Policy (CSP) and ensure all administrative actions require multi-factor authentication (MFA) to limit the impact of session hijacking.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Apr 1, 2026, there are no reports of this vulnerability being used in active attacks. However, because the payload triggers on public-facing pages, the reach of this exploit is significantly larger than typical backend XSS.

Analyst Recommendation

Due to the high CVSS score and the public-facing nature of the vulnerability, immediate patching is the only viable solution. Organizations must update to version 0.31.0.0 to protect their users and their administrative integrity.

---METADATA---
VENDOR: CI4MS
PRODUCT: CI4MS
AFFECTED_VERSIONS: Prior to 0.31.0.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A stored cross-site scripting (XSS) vulnerability in the CI4MS CMS allows attackers to inject and execute malicious JavaScript payloads via blog post content.

Executive Summary:
A stored XSS vulnerability in CI4MS allows unauthorized actors to inject malicious scripts into blog posts, potentially leading to full session compromise for visiting users.

Vulnerability Details

CVE-ID: CVE-2026-34568

Affected Software: CI4MS

Affected Versions: Prior to 0.31.0.0

Vulnerability: The application fails to properly sanitize user-controlled input within the blog post creation/editing module. This results in stored XSS, where malicious scripts are executed in the browsers of users viewing the compromised content.

Business Impact

With a CVSS score of 9.1, this vulnerability poses a high risk of session hijacking, cookie theft, and unauthorized redirection of users. Successful exploitation could allow an attacker to gain elevated privileges if an administrator views the malicious content, leading to a complete compromise of the CMS.

Remediation Plan

Immediate Action: Update the CI4MS installation to version 0.31.0.0, which includes necessary input sanitization and output encoding improvements.

Proactive Monitoring: Monitor web application logs for unusual script tags or character sequences in blog post submissions and review browser console errors for potential XSS triggers.

Compensating Controls: Deploy a robust Web Application Firewall (WAF) configured to detect and block common XSS payloads in HTTP request bodies.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of Apr 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Stored XSS is a high-impact vulnerability that can be used to bypass client-side security controls. Administrators should expedite the patching process to version 0.31.0.0 to ensure that all user-supplied input is correctly neutralized before rendering.

---METADATA---
VENDOR: CI4MS
PRODUCT: CI4MS
AFFECTED_VERSIONS: Prior to 0.31.0.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A stored cross-site scripting (XSS) vulnerability in the CI4MS Categories section allows attackers to inject malicious scripts that execute when categories are viewed.

Executive Summary:
A stored XSS vulnerability in the CI4MS Categories module allows attackers to inject malicious code that executes in the context of other users' browsers.

Vulnerability Details

CVE-ID: CVE-2026-34567

Affected Software: CI4MS

Affected Versions: Prior to 0.31.0.0

Vulnerability: The application lacks sufficient output encoding for user-supplied data in the Categories section. Malicious JavaScript injected into categories is stored server-side and executed whenever those categories are rendered within the application.

Business Impact

The CVSS score of 9.1 highlights the critical nature of this flaw, as it allows attackers to compromise the integrity of the user experience. Successful exploitation could lead to the theft of session tokens, unauthorized performative actions, or the delivery of malicious content to administrative users.

Remediation Plan

Immediate Action: Update CI4MS to version 0.31.0.0, as this release remediates the underlying sanitization failures in the Categories module.

Proactive Monitoring: Audit existing category descriptions for injected scripts and monitor traffic for anomalous patterns involving the Categories management interface.

Compensating Controls: Utilize Content Security Policy (CSP) headers to restrict the sources from which scripts can be executed, significantly reducing the impact of stored XSS.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of Apr 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS severity, this vulnerability should be addressed immediately. Upgrading to version 0.31.0.0 is the only reliable method to ensure that input sanitization and output encoding are correctly applied across all vulnerable modules in the CMS.

---METADATA---
VENDOR: CI4MS
PRODUCT: CI4MS
AFFECTED_VERSIONS: Prior to 0.31.0.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
CI4MS versions prior to 0.31.0.0 are vulnerable to stored cross-site scripting (XSS) via unsanitized input in the Page Management functionality.

Executive Summary:
A stored cross-site scripting vulnerability in the CI4MS Page Management module allows attackers to execute arbitrary JavaScript in administrative and public-facing contexts.

Vulnerability Details

CVE-ID: CVE-2026-34566

Affected Software: CI4MS

Affected Versions: Prior to 0.31.0.0

Vulnerability: This is a stored cross-site scripting (XSS) vulnerability where the Page Management functionality fails to sanitize user-controlled input. An authenticated attacker can inject malicious JavaScript payloads that are executed when the content is rendered in administrative or public views.

Business Impact

Successful exploitation permits an attacker to hijack user sessions, perform unauthorized administrative actions, or deface public-facing pages. Given the CVSS score of 9.1, this vulnerability poses a severe risk to organizational integrity and data confidentiality, as it can lead to full compromise of user accounts within the CMS.

Remediation Plan

Immediate Action: Upgrade the CI4MS installation to version 0.31.0.0 or later to ensure proper output encoding is implemented.

Proactive Monitoring: Review web server and application logs for suspicious input patterns, particularly those containing script tags or encoded payloads, within page management requests.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict XSS filtering rules to inspect and block malicious payloads directed at the CMS input fields.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of Apr 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates an immediate update to version 0.31.0.0. Organizations should prioritize patching to prevent potential session hijacking and unauthorized administrative access stemming from this high-impact XSS flaw.

---METADATA---
VENDOR: CI4MS
PRODUCT: CI4MS
AFFECTED_VERSIONS: Prior to 0.31.0.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
CI4MS versions prior to 0.31.0.0 contain a stored cross-site scripting (XSS) vulnerability within the Menu Management functionality when adding Posts.

Executive Summary:
An authenticated stored cross-site scripting vulnerability in the CI4MS Menu Management feature exposes administrative and public users to malicious JavaScript execution.

Vulnerability Details

CVE-ID: CVE-2026-34565

Affected Software: CI4MS

Affected Versions: Prior to 0.31.0.0

Vulnerability: The application fails to sanitize post-related data when adding content to navigation menus. This allows an attacker to store malicious JavaScript payloads that execute unsafely within both administrative dashboards and public-facing navigation menus.

Business Impact

The ability to inject scripts into navigation menus threatens the security of both backend administrators and frontend users. With a CVSS score of 9.1, this vulnerability allows for severe impact, including unauthorized data access and potential escalation of privileges via session theft.

Remediation Plan

Immediate Action: Apply the vendor-provided patch by upgrading the CI4MS application to version 0.31.0.0.

Proactive Monitoring: Monitor administrative audit logs for unusual changes to navigation menus or post associations that could indicate an injection attempt.

Compensating Controls: Implement a Content Security Policy (CSP) to restrict the execution of inline scripts and unauthorized external resources as a temporary mitigation.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of Apr 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this XSS vulnerability, immediate remediation is required. Administrators should verify that all affected CI4MS instances are updated to version 0.31.0.0 to eliminate the injection vector and secure the navigation menu subsystem.

---METADATA---
VENDOR: CI4MS
PRODUCT: CI4MS
AFFECTED_VERSIONS: Prior to 0.31.0.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
CI4MS versions prior to 0.31.0.0 are susceptible to stored cross-site scripting (XSS) due to improper input sanitization in the Menu Management functionality.

Executive Summary:
A critical stored cross-site scripting vulnerability in CI4MS Menu Management allows for the injection of malicious payloads into navigation menus, impacting administrative and public users.

Vulnerability Details

CVE-ID: CVE-2026-34564

Affected Software: CI4MS

Affected Versions: Prior to 0.31.0.0

Vulnerability: This vulnerability occurs when page-related data is added to navigation menus without proper output encoding. An attacker can store malicious JavaScript payloads that execute upon rendering in administrative interfaces or public-facing menus.

Business Impact

Exploitation of this flaw could result in the compromise of administrative sessions or the delivery of malicious content to end-users. The CVSS score of 9.1 reflects the high risk of widespread impact on the integrity and security of the CMS environment.

Remediation Plan

Immediate Action: Update the CI4MS software to version 0.31.0.0 to resolve the underlying sanitization failure.

Proactive Monitoring: Review application performance and error logs for signs of script injection or unexpected behavior in the navigation menu generation process.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter out common JavaScript patterns from input fields until the software can be successfully updated.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of Apr 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

It is imperative that affected organizations update to CI4MS version 0.31.0.0 immediately. Failure to patch may allow attackers to leverage this vulnerability to gain unauthorized access or manipulate content delivered to legitimate users.

---METADATA---
VENDOR: CI4MS
PRODUCT: CI4MS
AFFECTED_VERSIONS: Prior to 0.31.0.0
CONFIDENCE: high
MISSING: exploit_status
---END_METADATA---

Description Summary:
A stored blind cross-site scripting (XSS) vulnerability in CI4MS allows attackers to inject malicious JavaScript via backup filenames, which executes when viewed in backup management.

Executive Summary:
A stored Blind XSS vulnerability in CI4MS allows unauthorized script execution, potentially compromising administrative sessions and user data.

Vulnerability Details

CVE-ID: CVE-2026-34563

Affected Software: CI4MS

Affected Versions: Prior to 0.31.0.0

Vulnerability: The application fails to sanitize input within backup filenames during the upload process. An attacker can inject malicious payloads that are stored server-side and executed when an authenticated administrator accesses the backup management interface.

Business Impact

Successful exploitation allows for the execution of arbitrary JavaScript in the context of an administrator’s browser session. This can lead to session hijacking, unauthorized configuration changes, or the exfiltration of sensitive application data. With a CVSS score of 9.1, this vulnerability poses a critical risk to the integrity and confidentiality of the CMS.

Remediation Plan

Immediate Action: Upgrade the CI4MS installation to version 0.31.0.0 or later to implement required input sanitization and output encoding.

Proactive Monitoring: Audit application logs for suspicious characters or script tags within backup metadata fields.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common XSS patterns in file upload requests.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this stored XSS flaw, immediate patching is required to prevent potential compromise of administrative accounts. Organizations should prioritize upgrading to version 0.31.0.0 and review existing backups for any signs of malicious injection.

---METADATA---
VENDOR: CI4MS
PRODUCT: CI4MS
AFFECTED_VERSIONS: Prior to 0.31.0.0
CONFIDENCE: high
MISSING: exploit_status
---END_METADATA---

Description Summary:
A stored blind XSS vulnerability in the CI4MS logs interface allows attackers to execute malicious scripts when an administrator views the application logs.

Executive Summary:
CI4MS contains a stored Blind XSS vulnerability in its logging system, enabling potential malicious script execution within administrative sessions.

Vulnerability Details

CVE-ID: CVE-2026-34560

Affected Software: CI4MS

Affected Versions: Prior to 0.31.0.0

Vulnerability: The application fails to properly encode log data before rendering it in the logs interface. Attackers can inject malicious payloads into application logs, which execute once an administrator navigates to the log management dashboard.

Business Impact

This vulnerability enables attackers to perform actions on behalf of administrators, potentially leading to a full system compromise. The high CVSS score of 9.1 underscores the severity of allowing arbitrary code execution within the administrative control panel. Failure to remediate could result in significant data breaches or loss of administrative control.

Remediation Plan

Immediate Action: Update CI4MS to version 0.31.0.0 to ensure proper output encoding of all logged data.

Proactive Monitoring: Regularly review log files for anomalous entries containing script tags or unexpected characters.

Compensating Controls: Restrict access to the administrative logs interface to trusted IP addresses and utilize a WAF to filter malicious payloads from incoming requests.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The vulnerability represents a critical risk due to its ability to target administrative users through standard system monitoring interfaces. Applying the vendor-provided patch is the only effective way to mitigate this risk and ensure the security of the management console.

---METADATA---
VENDOR: CI4MS
PRODUCT: CI4MS
AFFECTED_VERSIONS: Prior to 0.31.0.0
CONFIDENCE: high
MISSING: exploit_status
---END_METADATA---

Description Summary:
A stored cross-site scripting (XSS) vulnerability in CI4MS allows attackers to inject malicious scripts into blog tags, executing in public and administrative interfaces.

Executive Summary:
A stored XSS vulnerability in CI4MS blog tags allows for the execution of malicious scripts, threatening both public users and administrative sessions.

Vulnerability Details

CVE-ID: CVE-2026-34559

Affected Software: CI4MS

Affected Versions: Prior to 0.31.0.0

Vulnerability: The application fails to sanitize input for blog tag creation and editing. These payloads are stored in the database and subsequently rendered without encoding on both public-facing pages and internal administrative dashboards.

Business Impact

This vulnerability allows attackers to compromise both public visitors and internal administrators. Potential impacts include credential theft, redirection to malicious sites, and unauthorized administrative actions, justifying the 9.1 CVSS score. Such widespread exposure threatens both brand reputation and the security of the underlying CMS infrastructure.

Remediation Plan

Immediate Action: Upgrade to version 0.31.0.0 to apply necessary input sanitization and output encoding for blog tags.

Proactive Monitoring: Scan existing blog tags for suspicious content and review web access logs for unusual requests targeting the tagging functionality.

Compensating Controls: Implement a Content Security Policy (CSP) to restrict the execution of inline scripts and unauthorized external resources.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Because this vulnerability affects both public and administrative interfaces, it is highly critical and requires immediate attention. Administrators must update to the latest version and verify that all existing tags are free of malicious payloads to fully secure the application.

---METADATA---
VENDOR: CI4MS
PRODUCT: CI4MS (CMS skeleton)
AFFECTED_VERSIONS: Prior to version 0.31.0.0
---END_METADATA---

Description Summary:
CI4MS is vulnerable to Stored DOM-Based Cross-Site Scripting in its Methods Management functionality, allowing for script execution in administrative and global navigation components.

Executive Summary:
Critical Stored DOM-Based XSS in CI4MS’s Methods Management allows attackers to execute malicious scripts across the administrative interface and global navigation.

Vulnerability Details

CVE-ID: CVE-2026-34558

Affected Software: CI4MS CI4MS

Affected Versions: Prior to version 0.31.0.0

Vulnerability: The application fails to sanitize input when creating or managing application methods/pages. Attacker-controlled JavaScript payloads are stored server-side and later rendered directly into the DOM of administrative interfaces and global navigation components without proper output encoding.

Business Impact

Because the malicious payloads are rendered in global navigation components, this vulnerability has a wide impact across the entire administrative console. Attackers can perform unauthorized actions on behalf of administrators, leading to full site compromise. The CVSS score of 9.1 reflects the high risk of session hijacking and data manipulation.

Remediation Plan

Immediate Action: Update CI4MS to version 0.31.0.0 immediately to ensure all method-related inputs are properly sanitized and encoded before being rendered in the DOM.

Proactive Monitoring: Audit the "Methods Management" entries for suspicious script tags and monitor for unauthorized changes to site navigation or permissions.

Compensating Controls: Deploy a WAF to filter out common XSS payloads in POST requests and enforce a strict CSP to mitigate the impact of DOM-based script execution.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 30, 2026, there is no public information indicating active exploitation. This vulnerability is particularly dangerous as it affects global components, increasing the likelihood of a successful administrative compromise.

Analyst Recommendation

Applying the 0.31.0.0 update is critical for maintaining the security of the CI4MS environment. Organizations should also perform a retrospective audit of their methods and pages to ensure no malicious payloads were introduced prior to patching.

---METADATA---
VENDOR: CI4MS
PRODUCT: CI4MS (CMS skeleton)
AFFECTED_VERSIONS: Prior to version 0.31.0.0
---END_METADATA---

Description Summary:
CI4MS is vulnerable to stored Cross-Site Scripting (XSS) in its group and role management functionality, allowing attackers to execute malicious scripts in administrative views.

Executive Summary:
A critical stored XSS vulnerability in CI4MS allows attackers to compromise administrative sessions by injecting malicious JavaScript into group and role management fields.

Vulnerability Details

CVE-ID: CVE-2026-34557

Affected Software: CI4MS CI4MS

Affected Versions: Prior to version 0.31.0.0

Vulnerability: The application fails to sanitize input in three distinct group-related fields within the RBAC management module. Malicious payloads are stored on the server and rendered without encoding in privileged administrative views, enabling stored Cross-Site Scripting (XSS).

Business Impact

This vulnerability can be used to hijack administrative sessions, steal CSRF tokens, or redirect administrators to malicious websites. Given the high CVSS score of 9.1, this stored XSS is considered critical because it targets the most privileged users of the CMS, potentially leading to a full application takeover.

Remediation Plan

Immediate Action: Upgrade CI4MS to version 0.31.0.0 or higher to implement proper input sanitization and output encoding for the affected management fields.

Proactive Monitoring: Inspect the database for existing JavaScript payloads in group and role tables and monitor for unusual administrative browser activity.

Compensating Controls: Implement a strong Content Security Policy (CSP) to prevent the execution of unauthorized inline scripts and restrict script sources.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 30, 2026, there is no public information indicating active exploitation. Stored XSS in administrative interfaces is a common vector for persistent administrative account compromise.

Analyst Recommendation

The severity of this XSS flaw necessitates an immediate update to version 0.31.0.0. Security teams should also verify that no malicious scripts have already been stored in the database prior to the update.

---METADATA---
VENDOR: Canonical
PRODUCT: LXD
AFFECTED_VERSIONS: Before 6.8
---END_METADATA---

Description Summary:
A backup import validation flaw in Canonical LXD allows authenticated remote attackers to bypass project restrictions and achieve full host compromise.

Executive Summary:
An authentication bypass vulnerability in the Canonical LXD backup import process allows an attacker to execute arbitrary configurations, leading to full host compromise.

Vulnerability Details

CVE-ID: CVE-2026-34178

Affected Software: Canonical LXD

Affected Versions: Before 6.8

Vulnerability: The vulnerability exists because the backup import process validates restrictions against the wrong file. An authenticated remote attacker with instance-creation permissions can craft a malicious archive to force privileged execution, bypassing security constraints.

Business Impact

The CVSS score of 9.1 highlights the critical nature of this flaw. By bypassing project restrictions, an attacker can gain full control over the host system, creating significant risk for data confidentiality, integrity, and availability within the affected LXD environment.

Remediation Plan

Immediate Action: Update all instances of Canonical LXD to version 6.8 or later to ensure backup integrity validation is enforced correctly.

Proactive Monitoring: Review logs for suspicious instance creation events or backup imports originating from untrusted or low-privilege users.

Compensating Controls: Implement strict Access Control Lists (ACLs) for users permitted to perform instance creation or backup restoration tasks.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators should treat this as a high-priority update. The ability for a restricted user to gain full host access via a simple backup import makes this a critical path for remediation to prevent catastrophic system failure.

---METADATA---
VENDOR: Langflow
PRODUCT: Langflow
AFFECTED_VERSIONS: 1.2.0 through 1.8.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Langflow contains an arbitrary file write vulnerability in the /api/v2/files/ endpoint, allowing authenticated attackers to achieve remote code execution.

Executive Summary:
An arbitrary file write vulnerability in Langflow allows authenticated attackers to perform remote code execution by bypassing existing filename validation.

Vulnerability Details

CVE-ID: CVE-2026-33309

Affected Software: Langflow

Affected Versions: 1.2.0 through 1.8.1

Vulnerability: The vulnerability exists due to a failure in boundary containment within the LocalStorageService component. Authenticated attackers can bypass path-parameter guards during multipart file uploads to the POST /api/v2/files/ endpoint to write files to the host system.

Business Impact

With a CVSS score of 9.9, this vulnerability poses a catastrophic risk to server integrity. An attacker who gains access to the application can write malicious scripts to the filesystem, resulting in full server compromise, unauthorized access to AI workflows, and potential lateral movement within the environment.

Remediation Plan

Immediate Action: Upgrade Langflow to version 1.9.0 or higher to resolve the architectural flaw in the file storage service.

Proactive Monitoring: Review web server logs for suspicious file upload activity, particularly requests directed at the /api/v2/files/ endpoint involving unusual file extensions.

Compensating Controls: Implement strict network ingress filtering to limit access to the Langflow management interface to trusted IP addresses only.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The CVSS score of 9.9 highlights the extreme danger posed by this RCE vulnerability. Organizations currently utilizing Langflow versions 1.2.0 through 1.8.1 must treat this as a high-priority update to prevent total system takeover.

---METADATA---
VENDOR: SiYuan
PRODUCT: SiYuan Knowledge Management System
AFFECTED_VERSIONS: 3.6.0 and below
---END_METADATA---

Description Summary:
SiYuan versions 3.6.0 and below contain an authorization bypass in the search endpoint, allowing authenticated users to execute arbitrary SQL statements against the underlying SQLite database.

Executive Summary:
A critical authorization bypass vulnerability in SiYuan allows any authenticated user, including those with restricted permissions, to execute arbitrary SQL commands and potentially compromise the entire application database.

Vulnerability Details

CVE-ID: CVE-2026-32767

Affected Software: SiYuan Knowledge Management System

Affected Versions: 3.6.0 and below

Vulnerability: This flaw exists in the /api/search/fullTextSearchBlock endpoint when the method parameter is set to 2. An authenticated attacker with "Reader" role privileges can bypass security middleware to inject raw SQL statements directly into the SQLite database.

Business Impact

A successful exploit grants an attacker full control over the application's data layer. This results in total loss of data confidentiality, integrity, and availability, as an attacker can exfiltrate, modify, or delete all stored knowledge and system tables. The CVSS score of 9.8 reflects the critical nature of this flaw, where a low-privileged user can cause catastrophic system-wide impact.

Remediation Plan

Immediate Action: Administrators must upgrade SiYuan to version 3.6.1 or later immediately to apply the necessary authorization and read-only checks to the affected endpoint.

Proactive Monitoring: Review application logs for unusual activity involving the /api/search/fullTextSearchBlock endpoint, specifically looking for SQL syntax or the use of method=2 by non-admin users.

Compensating Controls: Restrict network access to the SiYuan instance to trusted IP addresses and consider implementing a Web Application Firewall (WAF) to filter for common SQL injection patterns.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the ease of exploitation by any authenticated user and the critical impact on data integrity, the potential for internal or external exploitation is extremely high.

Analyst Recommendation

The severity of this vulnerability cannot be overstated, as it completely bypasses the application's security model. Organizations using SiYuan should prioritize the update to version 3.6.1. Failure to remediate this flaw leaves the entire knowledge base vulnerable to unauthorized manipulation or permanent deletion by any user with basic access.

---METADATA---
VENDOR: Apollo
PRODUCT: Federation
AFFECTED_VERSIONS: Prior to 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2
---END_METADATA---

Description Summary:
A prototype pollution vulnerability in Apollo Federation's query plan execution allows attackers to pollute Object.prototype, potentially leading to remote code execution or denial of service.

Executive Summary:
Apollo Federation is vulnerable to a critical prototype pollution flaw that allows malicious clients or compromised subgraphs to compromise the integrity of the entire gateway.

Vulnerability Details

CVE-ID: CVE-2026-32621

Affected Software: Apollo Federation

Affected Versions: Prior to 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2

Vulnerability: A vulnerability in the gateway's query plan execution allows for the pollution of Object.prototype. This can be triggered by a malicious client using field aliases/variables or by a compromised subgraph sending malicious JSON response payloads.

Business Impact

Prototype pollution in a central gateway like Apollo Federation is a Critical risk (CVSS 9.9). It can lead to Remote Code Execution (RCE), bypass of security logic, or persistent Denial of Service (DoS) across the entire application graph. This affects the core architecture of the organization's API ecosystem.

Remediation Plan

Immediate Action: Update Apollo Federation to version 2.9.6, 2.10.5, 2.11.6, 2.12.3, 2.13.2, or later to address the pollution flaw.

Proactive Monitoring: Audit GraphQL queries for unusual field aliasing patterns and monitor subgraph responses for unexpected JSON structures targeting prototype-inheritable properties.

Compensating Controls: Implement strict schema validation and use security libraries that freeze the Object.prototype to prevent modification at runtime.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of March 16, 2026, there is no public information indicating active exploitation. However, prototype pollution is a highly effective attack vector against Node.js-based environments.

Analyst Recommendation

Given the CVSS score of 9.9 and the central role Apollo Federation plays in modern API architectures, this update must be applied immediately. Security teams should coordinate with development teams to ensure all gateways and subgraphs are running the patched versions to maintain the integrity of the unified graph.

---METADATA---
VENDOR: FacturaScripts
PRODUCT: FacturaScripts
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
FacturaScripts accounting and invoicing software contains an unspecified vulnerability requiring immediate attention.

Executive Summary:
FacturaScripts is affected by a security vulnerability that may expose accounting systems to unauthorized access or compromise.

Vulnerability Details

CVE-ID: CVE-2026-27891

Affected Software: FacturaScripts

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The provided data lacks specific technical details regarding the vulnerability type or the authentication requirements necessary for exploitation.

Business Impact

The vulnerability carries a CVSS score of 7.2, placing it in the High severity category. Successful exploitation could lead to unauthorized access to sensitive financial data, invoicing manipulation, or potential disruption of core business accounting operations.

Remediation Plan

Immediate Action: Monitor official FacturaScripts security channels for patch availability and apply updates as soon as they are released.

Proactive Monitoring: Review application access logs for unauthorized administrative activity or unusual API requests.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict rules to block suspicious traffic patterns directed at the accounting interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the software, the potential for exploitation is high.

Analyst Recommendation

Given the High severity rating, administrators must prioritize the monitoring of the FacturaScripts vendor advisory portal. Apply all security patches immediately upon release to mitigate the risk of data exposure.

---METADATA---
VENDOR: Wazuh
PRODUCT: Wazuh Manager
AFFECTED_VERSIONS: 4.0.0 through 4.14.2
---END_METADATA---

Description Summary:
Wazuh deployments in cluster mode are vulnerable to Remote Code Execution via deserialization of untrusted data if a worker node is compromised.

Executive Summary:
Wazuh Manager is vulnerable to a critical Remote Code Execution flaw that allows a compromised worker node to gain root access to the master node via insecure data deserialization.

Vulnerability Details

CVE-ID: CVE-2026-25769

Affected Software: Wazuh Manager

Affected Versions: 4.0.0 through 4.14.2

Vulnerability: This vulnerability is caused by the deserialization of untrusted data within the Wazuh cluster communication protocol. An attacker who has gained access to a worker node can send malicious serialized data to the master node to achieve full RCE with root privileges.

Business Impact

A compromise of the master node in a Wazuh cluster results in a total loss of control over the security monitoring infrastructure. With a CVSS score of 9.1, this flaw allows for lateral movement from a single compromised node to the entire security stack, potentially leading to the destruction of logs and detection rules.

Remediation Plan

Immediate Action: Upgrade all Wazuh cluster components (Master and Workers) to version 4.14.3 or later to patch the deserialization flaw.

Proactive Monitoring: Monitor network traffic between cluster nodes for unexpected payloads and audit the master node for unauthorized root-level process execution.

Compensating Controls: Isolate cluster communication to a private network and use mutual TLS (mTLS) to ensure only authorized nodes can communicate with the master.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 17, 2026, there is no public information indicating active exploitation of this vulnerability. Deserialization vulnerabilities are highly dangerous as they often lead to reliable RCE.

Analyst Recommendation

Immediate patching is required for all Wazuh installations utilizing a master/worker architecture. Ensuring that the manager is updated to version 4.14.3 is the only effective way to prevent a compromised worker from taking over the entire security environment.

---METADATA---
VENDOR: Cloudreve
PRODUCT: Cloudreve
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
Cloudreve, a self-hosted file management system, is affected by a security vulnerability that could lead to unauthorized file access or administrative compromise.

Executive Summary:
Cloudreve file management software contains a high-severity vulnerability that could allow attackers to gain unauthorized access to stored files or take control of the management system.

Vulnerability Details

CVE-ID: CVE-2026-25726

Affected Software: Cloudreve

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: A security flaw exists in the Cloudreve self-hosted file management system. Given the nature of the software, the vulnerability likely involves improper access control or a bypass of authentication mechanisms, potentially allowing an attacker to access files belonging to other users.

Business Impact

The impact of this vulnerability is significant, as Cloudreve is used for file sharing and management. An attacker could exfiltrate sensitive documents, delete critical data, or compromise the entire file-sharing infrastructure. The CVSS score of 8.1 indicates a High severity and a substantial risk to data confidentiality and availability.

Remediation Plan

Immediate Action: Update Cloudreve to the latest version immediately to mitigate the identified security risks.

Proactive Monitoring: Audit file access logs for unusual download activity or unauthorized attempts to access restricted directories.

Compensating Controls: Implement strong network-level access controls and ensure that the Cloudreve instance is protected by a robust authentication provider and a WAF.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, with a CVSS score of 8.1, this vulnerability is a prime candidate for exploitation.

Analyst Recommendation

Due to the high CVSS score and the sensitive nature of file management systems, this vulnerability should be addressed with the highest urgency. Applying the vendor-provided patch is critical to securing the data stored within the Cloudreve platform.

---METADATA---
VENDOR: Flos Freeware
PRODUCT: Notepad2
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security flaw has been discovered in Flos Freeware Notepad2 that could potentially allow for unauthorized code execution or system compromise.

Executive Summary:
Flos Freeware Notepad2 is susceptible to a security flaw that could enable attackers to compromise workstation integrity through malicious file interactions.

Vulnerability Details

CVE-ID: CVE-2026-2538

Affected Software: Flos Freeware Notepad2

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The flaw resides within the Notepad2 application. While specific technical details are limited, vulnerabilities in text editors typically involve insecure file parsing or buffer overflows triggered when a user opens a specially crafted malicious file.

Business Impact

Exploitation of this vulnerability could result in arbitrary code execution on an end-user's workstation, leading to data exfiltration or lateral movement within the corporate network. The CVSS score of 7.0 (High) underscores the potential for significant operational disruption and the loss of sensitive information stored on local machines.

Remediation Plan

Immediate Action: Update Notepad2 to the most recent version available from the vendor to close the identified security gap.

Proactive Monitoring: Review system logs for suspicious process spawning or unusual file system activity originating from the Notepad2 executable.

Compensating Controls: Utilize application whitelisting and restrict users from opening untrusted text files from external or unverified sources.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 16, 2026, there is no public information indicating active exploitation of this vulnerability. Given the ubiquity of text editors in daily workflows, this flaw represents an attractive vector for social engineering attacks.

Analyst Recommendation

This vulnerability presents a high risk to endpoint security and should be addressed immediately. Administrators should prioritize the deployment of the official patch to all workstations running Notepad2 to prevent potential exploitation via malicious document handling.

---METADATA---
VENDOR: Arch (Node.js Library)
PRODUCT: Compressing
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A vulnerability in the 'Compressing' Node.js library could allow for arbitrary file manipulation during the compression or decompression process.

Executive Summary:
The 'Compressing' library for Node.js contains a high-severity vulnerability that could allow attackers to perform unauthorized file writes on the host system.

Vulnerability Details

CVE-ID: CVE-2026-24884

Affected Software: Compressing (Node.js library)

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability likely involves a "Zip Slip" or path traversal flaw within the compression/uncompression functions. An attacker providing a malicious archive could potentially write files to arbitrary locations on the server, often without authentication if the library processes user-uploaded files.

Business Impact

A CVSS score of 8.4 reflects the high risk of Remote Code Execution (RCE) or system takeover. By overwriting critical system files or application code, an attacker can gain persistent access to the server, leading to data theft and significant operational impact.

Remediation Plan

Immediate Action: Developers should update the 'Compressing' dependency in their package.json to the latest secure version and redeploy affected applications.

Proactive Monitoring: Audit application code to ensure that all file paths extracted from archives are validated and sanitized before being written to the disk.

Compensating Controls: Run Node.js applications in a restricted environment (e.g., containers with read-only file systems where possible) to limit the impact of unauthorized file writes.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation. Library vulnerabilities are particularly dangerous as they can affect a wide range of downstream applications.

Analyst Recommendation

We strongly recommend that development teams audit their Node.js projects for the 'Compressing' library and update it immediately. Failure to patch this library could leave servers vulnerable to full system compromise via malicious file uploads.

---METADATA---
VENDOR: Weaver
PRODUCT: E-cology 10.0
AFFECTED_VERSIONS: Prior to 20260312
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Weaver E-cology 10.0 contains an unauthenticated remote code execution vulnerability in the dubboApi debug endpoint, which is currently being exploited in the wild.

Executive Summary:
An unauthenticated remote code execution vulnerability in Weaver E-cology 10.0 is being actively exploited in the wild, posing an immediate threat to system security.

Vulnerability Details

CVE-ID: CVE-2026-22679

Affected Software: Weaver E-cology 10.0

Affected Versions: Prior to 20260312

Vulnerability: The vulnerability exists in the /papi/esearch/data/devops/dubboApi/debug/method endpoint. Unauthenticated attackers can send crafted POST requests containing malicious interfaceName and methodName parameters to execute arbitrary system commands.

Business Impact

With a CVSS score of 9.8 and confirmed active exploitation, this vulnerability presents an extreme risk to organizational infrastructure. Successful exploitation allows for complete remote system compromise, data theft, and the deployment of persistent threats within the network.

Remediation Plan

Immediate Action: Update Weaver E-cology 10.0 to version 20260312 or later immediately to remove the vulnerable debug functionality.

Proactive Monitoring: Monitor network traffic for POST requests directed at the /papi/esearch/data/devops/dubboApi/debug/method endpoint and inspect system logs for unexpected command execution.

Compensating Controls: Disable the affected debug endpoint at the web server or firewall level if an immediate update is not feasible.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of Apr 7, 2026, exploitation evidence has been observed in the wild by the Shadowserver Foundation. Immediate patching is required as this is an actively targeted vulnerability.

Analyst Recommendation

This is a critical, actively exploited vulnerability. Organizations running Weaver E-cology 10.0 must treat this as a high-priority incident and apply the necessary patches immediately to mitigate the risk of unauthorized remote command execution.

---METADATA---
VENDOR: Arch
PRODUCT: prompts
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability has been identified in the "prompts" library, potentially impacting applications that utilize this component for user input handling.

Executive Summary:
The "prompts" library, used by various applications, contains a high-risk vulnerability that could lead to improper input handling or unauthorized command execution.

Vulnerability Details

CVE-ID: CVE-2026-22661

Affected Software: prompts (library)

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability resides in the "prompts" library, a component often used in command-line interfaces to gather user input. With a CVSS score of 8.1, the flaw likely allows an attacker to bypass input validation or inject malicious sequences that the library fails to neutralize.

Business Impact

If an application uses a vulnerable version of this library to handle sensitive input or system commands, an attacker could potentially escalate privileges or execute arbitrary code. The risk is significant for developers and organizations that incorporate this library into their internal or external tools.

Remediation Plan

Immediate Action: Developers should update the "prompts" dependency in their projects to the latest secure version and rebuild their applications.

Proactive Monitoring: Review application logs for unusual input strings or unexpected behavior during interactive command-line sessions.

Compensating Controls: Implement additional server-side or application-level validation on all data received through the prompts library to ensure it meets expected formats.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation. Vulnerabilities in widely used libraries can have a significant "downstream" impact on many different products.

Analyst Recommendation

It is essential for development teams to inventory their use of the "prompts" library and apply updates immediately. Ensuring that all dependencies are current is a critical step in maintaining a secure software supply chain.

---METADATA---
VENDOR: Autodesk
PRODUCT: 3ds Max
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Autodesk 3ds Max is vulnerable to arbitrary code execution via an Untrusted Search Path flaw when opening a maliciously crafted project directory.

Executive Summary:
Opening a malicious project directory in Autodesk 3ds Max can lead to the execution of arbitrary code, potentially compromising the user's entire system.

Vulnerability Details

CVE-ID: CVE-2026-0662

Affected Software: Autodesk 3ds Max

Affected Versions: See vendor advisory

Vulnerability: This is an Untrusted Search Path vulnerability. When a user opens a specially crafted ".max" file or project directory, the application may load and execute a malicious DLL or script placed in that directory by an attacker, running in the context of the current process.

Business Impact

Successful exploitation allows an attacker to gain the same permissions as the local user, leading to data theft, malware installation, or persistent access to the workstation. In a corporate environment, this could be used as an entry point for lateral movement. The CVSS score of 7.8 reflects the high impact of local code execution.

Remediation Plan

Immediate Action: Update Autodesk 3ds Max to the latest version and avoid opening project files or directories from untrusted or unknown sources.

Proactive Monitoring: Use Endpoint Detection and Response (EDR) tools to monitor for suspicious child processes spawned by 3ds Max (e.g., cmd.exe or powershell.exe).

Compensating Controls: Implement "Least Privilege" access models for workstations and use application whitelisting to prevent the execution of unauthorized binaries.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation. This vulnerability relies on user interaction (social engineering), which is a common tactic for initial access in targeted attacks.

Analyst Recommendation

Users and administrators should treat all external 3ds Max project files with caution. Applying the vendor-supplied patch is the only definitive way to mitigate this risk and should be performed across all design workstations immediately.

---METADATA---
VENDOR: MLflow
PRODUCT: MLflow
AFFECTED_VERSIONS: Latest version (See vendor advisory for patch details)
---END_METADATA---

Description Summary:
An authentication bypass in MLflow's FastAPI job endpoints allows unauthenticated attackers to submit and execute jobs, potentially leading to remote code execution or denial of service.

Executive Summary:
MLflow installations are subject to a critical authentication bypass in job management endpoints, potentially leading to unauthenticated remote code execution and full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-0545

Affected Software: MLflow MLflow

Affected Versions: Latest version (at time of disclosure)

Vulnerability: The /ajax-api/3.0/jobs/* endpoints bypass basic-auth protections. If job execution is enabled, unauthenticated attackers can manage jobs, which may lead to shell execution or unauthorized filesystem access.

Business Impact

This vulnerability could allow an attacker to execute arbitrary code on the MLflow server, steal sensitive machine learning models, or disrupt operations through job spam. The CVSS score of 9.1 reflects the critical risk of unauthenticated access to privileged functions.

Remediation Plan

Immediate Action: Update MLflow to the latest version. If a patch is unavailable, disable job execution by setting MLFLOW_SERVER_ENABLE_JOB_EXECUTION=false immediately.

Proactive Monitoring: Review MLflow logs for job submissions from unknown IP addresses and monitor the server for unauthorized shell activity.

Compensating Controls: Implement an external authentication proxy or restrict access to the MLflow server using network-level firewalls and VPNs.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Apr 3, 2026, there is no public information indicating active exploitation. The vulnerability is particularly dangerous because it bypasses the standard authentication mechanism used by the application.

Analyst Recommendation

The potential for unauthenticated remote code execution makes this a critical priority. Organizations must either apply the latest security updates or disable the vulnerable job execution feature until a fix is verified.

---METADATA---
VENDOR: MLflow
PRODUCT: MLflow
AFFECTED_VERSIONS: Versions before v3.7.0
---END_METADATA---

Description Summary:
A path traversal vulnerability in MLflow's archive extraction function allows attackers to overwrite arbitrary files and escape sandboxed directories via malicious tar archives.

Executive Summary:
MLflow versions prior to v3.7.0 are vulnerable to a critical path traversal flaw that enables attackers to overwrite system files and potentially escape sandbox environments.

Vulnerability Details

CVE-ID: CVE-2025-15036

Affected Software: MLflow

Affected Versions: Versions before v3.7.0

Vulnerability: The vulnerability resides in the extract_archive_to_dir function within the artifact cache component, which fails to validate member paths during tar extraction. An attacker who can upload or provide a specially crafted tar.gz file can use directory traversal sequences (e.g., ../) to write files outside the intended directory.

Business Impact

Successful exploitation can lead to arbitrary file overwrites, which may result in privilege escalation, system instability, or full sandbox escape in multi-tenant environments. The CVSS score of 9.6 highlights the critical nature of this vulnerability and the high risk of unauthorized data access and system compromise.

Remediation Plan

Immediate Action: Upgrade MLflow to version v3.7.0 or higher to implement proper path validation during archive extraction.

Proactive Monitoring: Scan the file system for unexpected files created outside of the MLflow artifact directories and monitor for suspicious file write operations.

Compensating Controls: Use containerization with restricted file system permissions (read-only where possible) to limit the impact of a successful path traversal attack.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 30, 2026, there is no public information indicating active exploitation of this vulnerability. The flaw is a classic path traversal issue, which is frequently targeted by attackers in shared or multi-tenant cloud environments.

Analyst Recommendation

The ability to overwrite arbitrary files poses a significant risk to the integrity of the MLflow platform. It is strongly recommended that all users update to version v3.7.0 immediately to mitigate the risk of sandbox escapes and unauthorized system modification.

---METADATA---
VENDOR: VX
PRODUCT: VX Search
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
A security vulnerability has been identified in VX Search 13, which may expose the application to unauthorized exploitation.

Executive Summary:
VX Search 13 is affected by a security vulnerability that could lead to unauthorized access or system compromise, necessitating immediate administrative review.

Vulnerability Details

CVE-ID: CVE-2021-47974

Affected Software: VX VX Search

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects VX Search 13, though specific technical details regarding the exploit vector are currently limited. Security teams should treat all exposed instances of this software as potentially vulnerable to unauthorized interaction.

Business Impact

The vulnerability carries a CVSS score of 7.8, representing a High-risk profile that could result in unauthorized administrative access or information disclosure. Such impacts could severely threaten the confidentiality and integrity of data processed by the VX Search platform.

Remediation Plan

Immediate Action: Apply all available security patches or configuration updates released by the vendor for VX Search immediately.

Proactive Monitoring: Increase audit logging for the VX Search application and review logs for signs of unauthorized execution or unexpected configuration changes.

Compensating Controls: Restrict network access to the VX Search interface using firewalls or VPNs to ensure only authorized personnel can communicate with the service.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The CVSS score of 7.8 underscores the urgency of addressing this flaw. Organizations should verify their current installation version and implement vendor-supplied updates as a primary defense against potential compromise.

---METADATA---
VENDOR: LayerBB
PRODUCT: LayerBB
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
A security vulnerability has been identified in the LayerBB forum software that may allow for unauthorized system interaction.

Executive Summary:
A high-severity security flaw in LayerBB software could allow attackers to compromise the integrity and availability of the platform.

Vulnerability Details

CVE-ID: CVE-2021-47954

Affected Software: LayerBB

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves an unspecified security flaw within the LayerBB application, potentially allowing for unauthorized access or execution depending on the specific configuration.

Business Impact

The CVSS score of 8.2 indicates a high severity rating, suggesting that an exploit could lead to serious consequences, including unauthorized access to forum data or administrative functions. Such an incident could result in significant reputational damage and the loss of sensitive user information.

Remediation Plan

Immediate Action: Monitor official LayerBB release notes and apply all recommended security updates or patches immediately upon release.

Proactive Monitoring: Review web server and application logs for suspicious activity, particularly requests directed toward administrative or authentication endpoints.

Compensating Controls: Utilize a Web Application Firewall (WAF) to block known attack vectors and anomalous traffic patterns until a permanent fix is applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Users of LayerBB should treat this vulnerability as a high-priority item. Ensure that monitoring systems are configured to alert on unauthorized access attempts while waiting for the vendor to provide specific patch instructions.

---METADATA---
VENDOR: VX Search
PRODUCT: VX Search
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
A security vulnerability has been identified within the VX Search 10 software. Specific technical details regarding the nature of this flaw are currently limited.

Executive Summary:
The VX Search 10 software contains a security vulnerability that presents a substantial risk to information systems and data security.

Vulnerability Details

CVE-ID: CVE-2018-25328

Affected Software: VX Search 10

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability pertains to an unspecified security flaw within VX Search 10. The lack of detailed technical documentation prevents a definitive assessment of the authentication requirements or the specific attack vector.

Business Impact

With a CVSS score of 8.4, this vulnerability is categorized as high-severity. Successful exploitation could result in significant unauthorized access or system manipulation, posing a serious threat to the confidentiality and integrity of data processed by the application.

Remediation Plan

Immediate Action: Check the official VX Search website or vendor advisory notices for the latest security updates and apply them as soon as they are made available.

Proactive Monitoring: Monitor the application for unexpected behavior, such as unauthorized file access or anomalous system resource consumption.

Compensating Controls: If a patch is not immediately available, restrict access to the VX Search interface to authenticated users on a trusted network segment.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The high CVSS score necessitates immediate attention. Administrators should ensure that the affected software is monitored closely and that security patches are applied as the primary remediation step once released by the vendor.