---METADATA---
VENDOR: Infor
PRODUCT: Multiple Products
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
A vulnerability in the Graphics: WebGPU component of Infor products may lead to unauthorized information disclosure.

Executive Summary:
A critical information disclosure vulnerability in the Infor Graphics: WebGPU component poses a significant risk of unauthorized data exposure.

Vulnerability Details

CVE-ID: CVE-2026-8967

Affected Software: Infor Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is an information disclosure vulnerability residing within the Graphics: WebGPU component. The specific authentication requirements are currently unknown due to limited technical documentation.

Business Impact

Successful exploitation of this flaw could allow an attacker to gain access to sensitive internal data processed by the WebGPU component. Given the CVSS score of 7.5, this vulnerability represents a high risk that could lead to significant data breaches, potential loss of intellectual property, and erosion of customer trust.

Remediation Plan

Immediate Action: Identify all instances of affected Infor products within your environment and apply the latest security updates provided by the vendor.

Proactive Monitoring: Monitor server and application access logs for anomalous patterns or unauthorized requests directed at the Graphics subsystem.

Compensating Controls: Implement strict network segmentation and ensure that Web Application Firewalls (WAF) are configured to detect and block abnormal traffic patterns associated with the affected component.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations should prioritize the assessment of their Infor software footprint to determine exposure. Given the high severity, it is imperative to monitor official vendor communication channels for patch availability and to deploy those updates immediately upon release to mitigate the risk of information leakage.

---METADATA---
VENDOR: Infor
PRODUCT: Multiple Products
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
A vulnerability in the IP Protection component of Infor products may allow for unauthorized information disclosure.

Executive Summary:
A critical information disclosure vulnerability in the Infor IP Protection component could lead to the unauthorized exposure of sensitive intellectual property.

Vulnerability Details

CVE-ID: CVE-2026-8966

Affected Software: Infor Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the IP Protection component, potentially enabling an attacker to bypass security controls to access restricted information. The specific authentication requirements for this exploit are not currently defined.

Business Impact

The compromise of an IP Protection component carries severe business consequences, including the potential theft of proprietary data, trade secrets, or sensitive corporate intellectual property. The CVSS score of 7.5 reinforces the high-risk nature of this vulnerability, necessitating prompt attention to prevent long-term reputational and financial damage.

Remediation Plan

Immediate Action: Audit systems for the presence of the affected IP Protection component and apply all security patches issued by Infor.

Proactive Monitoring: Review audit logs for unauthorized access attempts to proprietary data repositories or unusual export activities.

Compensating Controls: Utilize Data Loss Prevention (DLP) solutions and enhanced access controls to restrict data egress while awaiting a formal vendor patch.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams must treat this vulnerability as a high-priority item. Rapid identification of affected software is required, and administrators should apply vendor-supplied updates as soon as they become available to prevent potential exploitation.

---METADATA---
VENDOR: Infor
PRODUCT: Multiple Products
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
A vulnerability in the DOM: Security component of Infor products may result in unauthorized information disclosure.

Executive Summary:
A critical information disclosure vulnerability within the Infor DOM: Security component presents a serious risk to the integrity and confidentiality of web-based application data.

Vulnerability Details

CVE-ID: CVE-2026-8965

Affected Software: Infor Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability exists within the DOM: Security component, which is responsible for enforcing security policies within the application's document object model. The specific conditions required for an attacker to trigger this disclosure remain undisclosed.

Business Impact

Exploitation of a security component vulnerability can effectively neutralize application-level defenses, leading to unauthorized data access or session compromise. With a CVSS score of 7.5, this issue is deemed high risk, as it could permit attackers to bypass security boundaries and access sensitive user or system information.

Remediation Plan

Immediate Action: Locate all affected Infor software deployments and apply the latest security updates immediately upon release.

Proactive Monitoring: Monitor application traffic for suspicious DOM-related activity or unusual security policy exceptions within system logs.

Compensating Controls: Ensure that modern browser security policies (such as Content Security Policy) are strictly enforced and utilize WAF rules to inspect incoming traffic for malicious payloads.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the central role of security components in protecting application integrity, this vulnerability should be addressed with urgency. IT teams must stay vigilant for updates from Infor and perform thorough testing before and after applying patches to ensure business continuity while closing this security gap.

---METADATA---
VENDOR: Infor
PRODUCT: Security: Process Sandboxing component
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: medium
MISSING: versions, patch
---END_METADATA---

Description Summary:
An information disclosure and sandbox escape vulnerability exists in the Infor Security: Process Sandboxing component.

Executive Summary:
A critical vulnerability in Infor's process sandboxing component allows for information disclosure and sandbox escape, threatening the isolation of secure processes.

Vulnerability Details

CVE-ID: CVE-2026-8958

Affected Software: Infor / Security: Process Sandboxing component

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves both information disclosure and a sandbox escape within the process sandboxing architecture. It indicates a failure to maintain process isolation, potentially allowing an attacker to gain access to system memory or restricted resources.

Business Impact

A sandbox escape is a severe security failure that compromises the fundamental isolation of the application, potentially leading to full system compromise or unauthorized access to sensitive business data. With a CVSS score of 8.6, this vulnerability represents a high-priority risk requiring immediate mitigation.

Remediation Plan

Immediate Action: Apply security updates provided by Infor immediately to restore the integrity of the process sandboxing mechanism.

Proactive Monitoring: Monitor system logs for signs of unauthorized process access or attempts to escape execution boundaries.

Compensating Controls: Ensure that the underlying operating system is hardened and that the application is running with the principle of least privilege to minimize the impact of a potential escape.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability carries a significant threat to system integrity. Administrators should prioritize the application of patches from Infor as soon as they become available to prevent potential sandbox breakouts and subsequent unauthorized access to the host environment.

---METADATA---
VENDOR: xiandafu
PRODUCT: beetl
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: patch, exploit_status, technical_details
---END_METADATA---

Description Summary:
A vulnerability has been identified in the xiandafu beetl template engine affecting versions up to 3.

Executive Summary:
The xiandafu beetl template engine contains a security vulnerability that poses a significant risk to applications relying on this component.

Vulnerability Details

CVE-ID: CVE-2026-8759

Affected Software: xiandafu beetl

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists in the xiandafu beetl template engine (up to version 3). The specific technical nature of the flaw is currently undisclosed, necessitating caution regarding unauthenticated or authenticated interaction depending on the integration.

Business Impact

The identified vulnerability carries a CVSS score of 7.3, categorizing it as a High-severity risk. Successful exploitation could potentially lead to unauthorized data access, template injection, or remote code execution, depending on how the application utilizes the beetl engine. This poses a substantial threat to the confidentiality, integrity, and availability of business applications.

Remediation Plan

Immediate Action: Review the xiandafu project documentation or security advisories to determine if a patch or update to version 3.x or later is available.

Proactive Monitoring: Monitor application logs for unusual template rendering behavior or unexpected system calls originating from the application server.

Compensating Controls: Implement input validation and sanitization for all data passed to template engines and ensure the application runs with the principle of least privilege.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the High severity score, stakeholders should prioritize investigating their dependency on the xiandafu beetl library. If the software is identified in your environment, apply the latest vendor-supplied updates or mitigation guidance immediately to reduce the attack surface.

---METADATA---
VENDOR: fishaudio
PRODUCT: Bert-VITS2
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: patch, exploit_status, technical_details
---END_METADATA---

Description Summary:
A vulnerability has been found in the fishaudio Bert-VITS2 project up to commit 8f7fbd8c4770965225d258db548da27dc8dd934c.

Executive Summary:
The fishaudio Bert-VITS2 project is affected by a security vulnerability that may expose systems to unauthorized exploitation.

Vulnerability Details

CVE-ID: CVE-2026-8756

Affected Software: fishaudio Bert-VITS2

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability impacts the Bert-VITS2 software up to commit 8f7fbd8c4770965225d258db548da27dc8dd934c. The specific technical root cause is currently unspecified, requiring users to monitor the project repository for formal security disclosures.

Business Impact

With a CVSS score of 7.3, this vulnerability represents a High-severity risk to deployments of Bert-VITS2. An attacker could potentially leverage this flaw to compromise the host environment or manipulate model processing, leading to service disruption or unauthorized data access.

Remediation Plan

Immediate Action: Verify your current version of Bert-VITS2 and upgrade to the latest stable release or commit provided by the upstream maintainers.

Proactive Monitoring: Audit environment logs for suspicious activity, particularly around the input processing modules of the VITS2 pipeline.

Compensating Controls: Restrict network access to the host running the software and ensure it is isolated from sensitive internal network segments.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should immediately assess their usage of the Bert-VITS2 project. Given the lack of specific technical details, maintaining a posture of least privilege and applying the latest available security updates is the most effective strategy for risk mitigation.

---METADATA---
VENDOR: Radare Project
PRODUCT: radare2
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, exploit_status, technical_details
---END_METADATA---

Description Summary:
The radare2 binary analysis framework is affected by a security vulnerability, the technical specifics of which are currently limited.

Executive Summary:
A security vulnerability in the radare2 binary analysis framework poses a significant risk to systems utilizing this tool for reverse engineering and debugging.

Vulnerability Details

CVE-ID: CVE-2026-8696

Affected Software: Radare Project radare2

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The provided documentation identifies a security issue within version 6 of radare2. The specific vulnerability type and authentication requirements remain undisclosed, requiring users to consult official upstream security advisories for technical clarity.

Business Impact

With a CVSS score of 7.5, this vulnerability is classified as High. If leveraged by an attacker, it could lead to arbitrary code execution or local system compromise, especially if radare2 is used to analyze untrusted or malicious binaries in an automated environment.

Remediation Plan

Immediate Action: Apply the latest security updates provided by the Radare Project as soon as they are made available.

Proactive Monitoring: Monitor system logs for unusual process execution patterns or crashes originating from radare2 components.

Compensating Controls: Ensure that radare2 is executed within a sandboxed or isolated environment to contain any potential impact from malicious file processing.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the limited technical information, users should treat this advisory with urgency and monitor the official repository for patch releases. Restricting the use of radare2 to secure, non-production environments is recommended until the patch is verified and deployed.

---METADATA---
VENDOR: ZKTeco
PRODUCT: CCTV Cameras
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
Certain ZKTeco CCTV cameras expose an undocumented, unauthenticated configuration export port that reveals sensitive information, including account credentials.

Executive Summary:
An unauthenticated configuration export vulnerability in ZKTeco CCTV cameras allows attackers to extract sensitive system credentials and service information.

Vulnerability Details

CVE-ID: CVE-2026-8598

Affected Software: ZKTeco CCTV cameras

Affected Versions: See vendor advisory

Vulnerability: This is an information disclosure vulnerability. An undocumented, unauthenticated port on the device provides access to a configuration export feature, which transmits sensitive data, including credentials, in plaintext.

Business Impact

The exposure of administrative credentials enables full, unauthorized access to the camera system. This could be leveraged for surveillance, credential stuffing against other internal systems, or persistent network infiltration. The 9.1 CVSS score reflects the high risk of this data exposure.

Remediation Plan

Immediate Action: Apply the latest security firmware update from ZKTeco.

Proactive Monitoring: Scan internal networks for ZKTeco devices and monitor for unauthorized connections to known configuration or management ports.

Compensating Controls: Block access to the identified configuration port via local firewall rules and ensure the cameras are placed on a restricted, non-public network.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations should immediately update their ZKTeco camera firmware to disable the insecure configuration port. If updates are not immediately available, restrict network access to the devices to prevent unauthorized access.

---METADATA---
VENDOR: Infor
PRODUCT: Keycloak
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: low
MISSING: versions, patch, exploit_status, technical_details
---END_METADATA---

Description Summary:
A security flaw has been identified within the Keycloak identity and access management product.

Executive Summary:
A vulnerability has been identified in Infor's implementation of Keycloak, necessitating immediate review of security bulletins to determine the scope of impact.

Vulnerability Details

CVE-ID: CVE-2026-7571

Affected Software: Infor Keycloak

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: A vulnerability exists within the Keycloak component as utilized by Infor products. Specific technical details regarding the authentication requirements or the nature of the flaw are currently limited.

Business Impact

As Keycloak is an identity and access management (IAM) solution, any vulnerability potentially impacts the security of all integrated applications. With a CVSS score of 7.1, this flaw should be treated as a High priority, as it may allow for unauthorized access to authentication tokens or administrative functions.

Remediation Plan

Immediate Action: Monitor official Infor security advisories for specific patch information and guidance on mitigating this vulnerability.

Proactive Monitoring: Review authentication logs and audit trails for anomalous access patterns or unauthorized administrative actions within the Keycloak environment.

Compensating Controls: Ensure that access to the Keycloak administration console is restricted to trusted internal networks and utilize multi-factor authentication (MFA) for all administrative accounts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Because Keycloak is a centralized point of failure for identity services, security teams must prioritize checking for official updates. Until a patch is applied, ensure that all administrative interfaces are hardened and access is strictly controlled.

---METADATA---
VENDOR: Keycloak (Red Hat)
PRODUCT: Keycloak
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: medium
MISSING: patch, technical_details
---END_METADATA---

Description Summary:
A flaw in Keycloak’s URL validation logic during redirect operations could allow for open redirection or potential security bypasses.

Executive Summary:
An improper URL validation vulnerability in Keycloak during redirect operations presents a risk of unauthorized redirection or security bypass.

Vulnerability Details

CVE-ID: CVE-2026-7504

Affected Software: Red Hat Keycloak

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability stems from flaws in the URL validation logic within Keycloak's redirect operations. The issue may allow an attacker to bypass intended security constraints during redirection, potentially facilitating phishing or other malicious activities by redirecting users to unauthorized locations.

Business Impact

Exploitation of this vulnerability can be used to facilitate social engineering attacks or bypass security controls that rely on trusted redirect paths. With a CVSS score of 8.1, the risk is elevated, as it can be leveraged to redirect authenticated users to malicious sites, potentially resulting in credential theft or further system compromise.

Remediation Plan

Immediate Action: Apply the latest security updates released by the vendor to address the URL validation flaw.

Proactive Monitoring: Monitor application logs for unexpected or suspicious redirect patterns that deviate from standard authentication flows.

Compensating Controls: Implement strict allow-lists for redirect URLs within the application configuration to mitigate the risk of unauthorized redirection.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this flaw necessitates prompt remediation. Administrators should ensure that all instances of Keycloak are updated to the latest version to correct the underlying URL validation logic and prevent the exploitation of redirect operations.

---METADATA---
VENDOR: DivvyDrive Information Technologies Inc.
PRODUCT: DivvyDrive
AFFECTED_VERSIONS: 4.8.2.9 through 4.8.3.1
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
DivvyDrive contains an open redirect vulnerability that facilitates parameter injection, potentially allowing attackers to redirect users to malicious external domains.

Executive Summary:
A critical open redirect and parameter injection vulnerability in DivvyDrive exposes users to phishing and malicious redirection, warranting immediate attention.

Vulnerability Details

CVE-ID: CVE-2026-6795

Affected Software: DivvyDrive Information Technologies Inc. DivvyDrive

Affected Versions: 4.8.2.9 before 4.8.3.2

Vulnerability: The software fails to properly validate user-supplied input in URL parameters, leading to an open redirect flaw. An unauthenticated attacker can leverage this to inject arbitrary parameters, potentially tricking users into interacting with malicious third-party content.

Business Impact

With a CVSS score of 9.6, this vulnerability poses a significant risk to organizational security. Successful exploitation can facilitate sophisticated phishing campaigns, leading to credential theft, unauthorized data access, and severe reputational damage.

Remediation Plan

Immediate Action: Upgrade to DivvyDrive version 4.8.3.2 or the latest available release provided by the vendor.

Proactive Monitoring: Review web server access logs for anomalous URL parameters and unexpected redirects to external domains.

Compensating Controls: Implement strict allow-lists for redirect destinations within your Web Application Firewall (WAF) to prevent unauthorized external redirection.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical CVSS severity, administrators should prioritize patching DivvyDrive to version 4.8.3.2 immediately. Failure to address this vulnerability increases the risk of successful social engineering attacks against your user base.

---METADATA---
VENDOR: Infor
PRODUCT: Multiple Products
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A privilege escalation vulnerability in Infor web applications allows standard users to gain super administrator access via parameter manipulation.

Executive Summary:
A critical privilege escalation vulnerability in Infor products allows authenticated users to gain unauthorized super administrator access, posing a severe risk of complete system compromise.

Vulnerability Details

CVE-ID: CVE-2026-6356

Affected Software: Infor Multiple Products

Affected Versions: See vendor advisory

Vulnerability: This is a privilege escalation vulnerability where an authenticated standard user can manipulate parameters to elevate their privileges to those of a super administrator.

Business Impact

The ability for a standard user to escalate to super administrator status grants an attacker full control over the affected application. This leads to unauthorized access to sensitive data, the potential for data exfiltration, and the ability to modify system configurations, resulting in significant operational and reputational damage. The CVSS score of 9.6 reflects the high impact on confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Update all affected Infor software installations to the latest vendor-provided version immediately.

Proactive Monitoring: Review application access logs for unusual administrative activity or changes to user permission structures initiated by non-administrative accounts.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to inspect and sanitize incoming HTTP parameters for unexpected structural modifications.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical severity of this privilege escalation flaw, organizations must prioritize patching. Failure to remediate this vulnerability could allow malicious actors to gain full administrative control over the business environment, leading to catastrophic data loss or system manipulation.

---METADATA---
VENDOR: DivvyDrive
PRODUCT: DivvyDrive
AFFECTED_VERSIONS: 4.8.2.9 through 4.8.3.1
---END_METADATA---

Description Summary:
A Cross-Site Request Forgery (CSRF) vulnerability in DivvyDrive versions 4.8.2.9 through 4.8.3.1 allows unauthorized actions to be performed on behalf of authenticated users.

Executive Summary:
A critical Cross-Site Request Forgery (CSRF) vulnerability in DivvyDrive allows attackers to trick users into executing unauthorized actions within the application.

Vulnerability Details

CVE-ID: CVE-2026-5791

Affected Software: DivvyDrive

Affected Versions: 4.8.2.9 through 4.8.3.1

Vulnerability: The application lacks sufficient CSRF protection, allowing an attacker to craft a malicious request that executes actions with the privileges of an authenticated user. This could lead to unauthorized data modification or administrative actions without the user's consent.

Business Impact

The CVSS score of 9.6 highlights the high risk associated with this flaw. CSRF can lead to the unauthorized changing of user passwords, deletion of data, or modification of system settings, severely impacting business operations and data integrity.

Remediation Plan

Immediate Action: Update the DivvyDrive installation to version 4.8.3.2 or later to ensure proper CSRF tokens and protections are in place.

Proactive Monitoring: Review audit logs for suspicious or unauthorized actions initiated by users that do not correspond to known internal workflows.

Compensating Controls: Ensure that users are properly logged out of the application when not in use and consider implementing browser-based protections or WAF rules to filter suspicious requests.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

CSRF vulnerabilities can be easily weaponized to perform actions that compromise the entire application environment. Administrators must move quickly to patch DivvyDrive to version 4.8.3.2 or later to prevent potential exploitation and maintain the integrity of user and system data.

---METADATA---
VENDOR: Mintplex Labs
PRODUCT: AnythingLLM
AFFECTED_VERSIONS: 1.9.1 and earlier
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A path traversal vulnerability in the AgentFlows component of AnythingLLM allows unauthenticated attackers to read or delete arbitrary files on the server.

Executive Summary:
A critical path traversal vulnerability in AnythingLLM allows unauthorized access to sensitive files, including API keys, and potential denial of service.

Vulnerability Details

CVE-ID: CVE-2026-5627

Affected Software: Mintplex Labs AnythingLLM

Affected Versions: 1.9.1 and earlier

Vulnerability: The vulnerability is located within the AgentFlows component due to improper input validation in loadFlow and deleteFlow methods. An unauthenticated attacker can manipulate file paths to escape the intended directory, allowing for arbitrary file disclosure or deletion.

Business Impact

With a CVSS score of 9.1, this vulnerability poses a severe risk to confidentiality and availability. Unauthorized access to configuration files can expose sensitive API keys, while the ability to delete system files leads to service disruption, causing significant operational downtime.

Remediation Plan

Immediate Action: Upgrade to AnythingLLM version 1.12.1 or later to resolve the path traversal flaw.

Proactive Monitoring: Audit server access logs for requests containing directory traversal sequences (e.g., ../) targeting the AgentFlows API endpoints.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter and block requests containing path traversal patterns before they reach the application.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this path traversal vulnerability necessitates an immediate update to the patched version. Administrators should also audit their server environments to ensure that sensitive configuration files were not compromised prior to the application of the patch.

---METADATA---
VENDOR: OVN (Open Virtual Network)
PRODUCT: Open Virtual Network
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security flaw has been identified in the Open Virtual Network (OVN) that could impact the integrity of virtualized network environments.

Executive Summary:
A critical security flaw within the Open Virtual Network (OVN) infrastructure poses a high risk to the stability and security of virtualized network environments.

Vulnerability Details

CVE-ID: CVE-2026-5367

Affected Software: OVN (Open Virtual Network)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a flaw in the OVN architecture, which may allow unauthorized actors to interfere with network policy enforcement or virtual machine traffic isolation.

Business Impact

A CVSS score of 8.6 highlights the potential for severe impact on virtualized data centers. Successful exploitation could lead to lateral movement between virtual networks, unauthorized access to sensitive data segments, and total loss of network isolation.

Remediation Plan

Immediate Action: Apply the latest security patches or updates provided by the OVN project or relevant distribution vendors.

Proactive Monitoring: Review OVN controller and database logs for suspicious configuration changes or unexpected network topology modifications.

Compensating Controls: Implement strict network segmentation and egress filtering to limit the potential blast radius should the virtual networking layer be compromised.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams managing virtualized infrastructure must treat this update as a high priority. Ensure that all OVN components are synchronized with the latest patched versions to maintain the integrity of the software-defined network.

---METADATA---
VENDOR: Keycloak
PRODUCT: Keycloak
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability has been identified in Keycloak, an open-source identity and access management solution, which could compromise authentication integrity.

Executive Summary:
Keycloak is affected by a critical flaw that could allow attackers to undermine identity management and gain unauthorized access to protected applications.

Vulnerability Details

CVE-ID: CVE-2026-4636

Affected Software: Keycloak

Affected Versions: See vendor advisory for affected versions

Vulnerability: The vulnerability exists within the Keycloak core identity management framework. While specific technical details are limited, flaws in such systems typically involve authentication bypasses, improper token validation, or privilege escalation vulnerabilities that can be exploited by an attacker.

Business Impact

Keycloak is a central component for authentication across many enterprises; therefore, a compromise here could grant an attacker access to any application integrated with the service. The CVSS score of 8.1 reflects the high risk of unauthorized data access and the potential for widespread lateral movement within an organization's infrastructure.

Remediation Plan

Immediate Action: Apply the latest security patches from the Keycloak project immediately to secure the identity provider.

Proactive Monitoring: Review Keycloak audit logs for unusual login patterns, unauthorized client registrations, or unexpected changes to realm roles and permissions.

Compensating Controls: Enable Multi-Factor Authentication (MFA) for all users and restrict access to the Keycloak admin console to internal, trusted networks only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation. However, identity providers are high-value targets for attackers, and the potential for exploitation is considered high.

Analyst Recommendation

Organizations relying on Keycloak for identity and access management must treat this vulnerability with the highest urgency. Applying the vendor's security updates is the only effective way to mitigate the risk to the entire authentication chain.

---METADATA---
VENDOR: Netatalk
PRODUCT: Netatalk 3
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: medium
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
Multiple heap out-of-bounds read vulnerabilities exist in the Spotlight RPC unmarshalling code within Netatalk 3, potentially leading to information disclosure.

Executive Summary:
Heap out-of-bounds read vulnerabilities in Netatalk 3 could permit an attacker to access sensitive memory information, threatening the confidentiality of the affected system.

Vulnerability Details

CVE-ID: CVE-2026-44066

Affected Software: Netatalk Netatalk 3

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves heap out-of-bounds reads during the unmarshalling of Spotlight RPC requests. This flaw may allow an attacker to read data outside of intended memory boundaries.

Business Impact

Exploitation of this memory corruption vulnerability can lead to unauthorized information disclosure, potentially exposing sensitive data residing in memory. With a CVSS score of 7.1, this is a High severity issue that requires immediate attention to prevent the leakage of credentials or other critical system information.

Remediation Plan

Immediate Action: Update all installations of Netatalk 3 to the latest version as recommended by the vendor to address the memory handling errors.

Proactive Monitoring: Monitor network traffic and server logs for unusual RPC requests or service crashes that may indicate an attempt to trigger memory corruption.

Compensating Controls: Deploy network-based intrusion detection systems to filter and inspect RPC traffic, blocking malformed packets that match the vulnerability signature.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations utilizing Netatalk 3 should treat this vulnerability as a high priority. Ensure that all affected systems are patched promptly, and consider restricting access to the Netatalk service to trusted networks only until updates are fully implemented.

---METADATA---
VENDOR: Netatalk
PRODUCT: Netatalk 1
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: medium
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
An out-of-bounds read vulnerability in the ASP session ID handling code of Netatalk 1 may result in information disclosure.

Executive Summary:
A vulnerability in Netatalk 1's session ID handling could allow an attacker to perform out-of-bounds reads, potentially leading to the compromise of sensitive memory contents.

Vulnerability Details

CVE-ID: CVE-2026-44064

Affected Software: Netatalk Netatalk 1

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability occurs during the processing of ASP session IDs, where an out-of-bounds read condition can be triggered. This may allow unauthorized access to adjacent memory areas.

Business Impact

Successful exploitation can result in the exposure of sensitive information stored in the application's memory space. Rated at 7.1 on the CVSS scale, this vulnerability poses a High severity risk, as memory disclosure can often serve as a precursor to more complex attacks or data exfiltration.

Remediation Plan

Immediate Action: Apply the latest security patches provided by the vendor for Netatalk 1 to remediate the session ID handling logic.

Proactive Monitoring: Review application logs for abnormal session activity or unexpected errors during authentication/session processes that could indicate exploitation attempts.

Compensating Controls: Utilize a Web Application Firewall or similar filtering mechanism to sanitize incoming session ID parameters and block malformed inputs.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

To mitigate the risk of memory disclosure, administrators should prioritize updating Netatalk 1 instances. If patching is not immediately feasible, restrict access to the affected service to minimize the exposure to potentially malicious actors.

---METADATA---
VENDOR: Unfurl
PRODUCT: Unfurl
AFFECTED_VERSIONS: Through 2025.08
---END_METADATA---

Description Summary:
Unfurl contains an improper input validation vulnerability in configuration parsing that enables Flask debug mode by default, potentially leading to remote code execution.

Executive Summary:
An improper input validation vulnerability in Unfurl allows unauthenticated attackers to enable Flask debug mode, leading to potential remote code execution and sensitive information disclosure.

Vulnerability Details

CVE-ID: CVE-2026-40035

Affected Software: Unfurl Unfurl

Affected Versions: Through 2025.08

Vulnerability: This is an improper input validation flaw within the application's configuration parsing logic. Because the debug configuration value is improperly evaluated as a boolean, an unauthenticated attacker can trigger the Werkzeug debugger to execute arbitrary code.

Business Impact

The vulnerability carries a CVSS score of 9.1, indicating a critical risk to organizational security. Successful exploitation allows for complete system compromise, enabling attackers to extract sensitive data or gain persistent unauthorized access, which could lead to significant reputational damage and operational disruption.

Remediation Plan

Immediate Action: Upgrade Unfurl to the latest version immediately to patch the insecure configuration parsing logic.

Proactive Monitoring: Monitor application logs for unauthorized access to the Werkzeug debugger interface or unusual Flask initialization patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block requests attempting to reach the Werkzeug debug endpoint or suspicious debug-related headers.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical severity of this vulnerability, organizations should prioritize patching as the primary mitigation strategy. Failure to address this could result in full remote control of the affected infrastructure, necessitating immediate attention from IT security teams.

---METADATA---
VENDOR: Ubiquiti
PRODUCT: UniFi OS
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
CONFIDENCE: medium
MISSING: versions, patch
---END_METADATA---

Description Summary:
A path traversal vulnerability in UniFi OS allows a low-privileged network attacker to access and manipulate sensitive system files.

Executive Summary:
A path traversal vulnerability in Ubiquiti UniFi OS devices could allow an authenticated network attacker to access and manipulate sensitive system files.

Vulnerability Details

CVE-ID: CVE-2026-34911

Affected Software: Ubiquiti UniFi OS

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a path traversal vulnerability that can be exploited by an attacker with low-level network access. By crafting specific requests, the attacker can access files outside the intended directory, potentially leading to the exposure or modification of sensitive configuration data.

Business Impact

Successful exploitation of this vulnerability could lead to the exposure of sensitive credentials, network configurations, or system information. With a CVSS score of 7.7, this high-severity flaw exposes the organization to significant risk of data breach and unauthorized system manipulation, potentially impacting the entire network infrastructure managed by the UniFi OS device.

Remediation Plan

Immediate Action: Identify all exposed UniFi OS devices and apply the latest security firmware updates provided by Ubiquiti as soon as they become available.

Proactive Monitoring: Inspect network traffic and system access logs for path traversal patterns, such as encoded directory symbols or attempts to access files in unexpected system locations.

Compensating Controls: Restrict management interface access to trusted, internal network segments and utilize a Web Application Firewall (WAF) to filter malicious requests targeting the device.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the risk of unauthorized file access, administrators must ensure their UniFi OS devices are kept up-to-date with the latest security patches. Isolate management interfaces from the public internet to reduce the attack surface and prevent unauthorized network-based exploitation.

---METADATA---
VENDOR: Infor
PRODUCT: Multiple Products
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security flaw has been identified in an unspecified component of Infor products.

Executive Summary:
A high-severity vulnerability in Infor products necessitates immediate attention to prevent potential system compromise.

Vulnerability Details

CVE-ID: CVE-2026-34003

Affected Software: Infor Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: A flaw was identified in an X component of the software, which, depending on the implementation, could be exploited to bypass security restrictions or access sensitive data.

Business Impact

With a CVSS score of 7.8, this vulnerability poses a significant risk to business operations relying on Infor software. Successful exploitation could lead to unauthorized access to enterprise data, potential system downtime, and a disruption of core business processes.

Remediation Plan

Immediate Action: Consult the official Infor security advisory to identify specific patches or configuration changes required for your product deployment and apply them immediately.

Proactive Monitoring: Review enterprise application logs for suspicious activity and unusual access patterns that could indicate unauthorized attempts to exploit the flaw.

Compensating Controls: Utilize network segmentation and access control lists to limit exposure of the Infor software to untrusted networks while patches are being applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations using Infor products must treat this vulnerability with high priority. It is essential to monitor vendor communications for specific remediation instructions and apply all relevant security updates to mitigate the risk of unauthorized system access.

---METADATA---
VENDOR: Spinnaker
PRODUCT: Spinnaker
AFFECTED_VERSIONS: Prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A SPeL injection vulnerability in the Spinnaker Echo service allows remote attackers to execute arbitrary Java code and access system files with full JVM privileges.

Executive Summary:
Spinnaker is subject to a critical remote code execution vulnerability that allows attackers to gain full system access via insecure SPeL expression processing.

Vulnerability Details

CVE-ID: CVE-2026-32613

Affected Software: Spinnaker

Affected Versions: Prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2

Vulnerability: The Echo service fails to restrict SPeL (Spring Expression Language) to a trusted context, allowing an authenticated or unauthenticated attacker (depending on deployment) to invoke arbitrary Java classes and execute commands on the underlying host.

Business Impact

The severity of this vulnerability is underscored by its CVSS score of 9.9, reflecting the potential for full system compromise. Successful exploitation grants attackers the ability to execute arbitrary commands, access sensitive credentials, and pivot within the infrastructure, leading to catastrophic data breaches and loss of control over the CI/CD pipeline.

Remediation Plan

Immediate Action: Upgrade Spinnaker to version 2026.1.0, 2026.0.1, 2025.4.2, or 2025.3.2. If patching cannot be performed immediately, disable the Echo service as a temporary workaround.

Proactive Monitoring: Review system logs for unusual process execution or unauthorized file access originating from the Echo service component.

Compensating Controls: Deploy a Web Application Firewall (WAF) or Runtime Application Self-Protection (RASP) tool to detect and block malicious expression language payloads directed at the Spinnaker services.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a total compromise vector. Security teams must treat this as a high-priority incident, ensuring that all Spinnaker instances are updated to the secure versions or that the vulnerable service is disabled to prevent exploitation.

---METADATA---
VENDOR: Moodle (Plugin by mdjnelson)
PRODUCT: Custom Certificate (mod_customcert)
AFFECTED_VERSIONS: Prior to versions 4.4.9 and 5.0.3
---END_METADATA---

Description Summary:
A critical flaw in the Moodle Custom Certificate plugin allows teachers to read or overwrite certificate elements from any other course in the system.

Executive Summary:
The Moodle Custom Certificate plugin contains a critical security flaw that allows authorized teachers to access and modify certificate data across different courses, leading to unauthorized data disclosure.

Vulnerability Details

CVE-ID: CVE-2026-30884

Affected Software: Custom Certificate Moodle Plugin (mod_customcert)

Affected Versions: Prior to versions 4.4.9 and 5.0.3

Vulnerability: The core_get_fragment and mod_customcert_save_element services fail to verify the context of a supplied elementid. This allows an authenticated teacher with management permissions in one course to manipulate certificates in any other course on the Moodle site.

Business Impact

This vulnerability enables cross-course data tampering and information disclosure, which can undermine the integrity of academic certifications. The CVSS score of 9.6 reflects the high impact on data integrity and confidentiality within the educational platform, potentially allowing for the unauthorized issuance of certificates.

Remediation Plan

Immediate Action: Update the Custom Certificate plugin to version 4.4.9 or 5.0.3 immediately through the Moodle plugin management interface.

Proactive Monitoring: Audit certificate modification logs for any changes made by users to courses they are not officially assigned to manage.

Compensating Controls: Review and restrict the mod/customcert:manage capability to only the most trusted administrative users until the patch is applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, the lack of context validation makes this vulnerability highly reliable for an authenticated attacker.

Analyst Recommendation

Moodle administrators must update the mod_customcert plugin to the fixed versions immediately. This action is necessary to prevent unauthorized users from compromising the validity of certificates across the entire installation.

---METADATA---
VENDOR: UXGROUP LLC
PRODUCT: Cast to TV Screen Mirroring
AFFECTED_VERSIONS: v2.2.77
---END_METADATA---

Description Summary:
UXGROUP LLC Cast to TV Screen Mirroring v2.2.77 is vulnerable to an arbitrary file overwrite during the import process, leading to code execution or data exposure.

Executive Summary:
An arbitrary file overwrite vulnerability in the Cast to TV Screen Mirroring application allows attackers to replace critical system files, potentially leading to full remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-30282

Affected Software: UXGROUP LLC Cast to TV Screen Mirroring

Affected Versions: v2.2.77

Vulnerability: This vulnerability occurs during the file import process of the application. An attacker can craft a malicious file that, when processed, overwrites critical internal application or system files, allowing for arbitrary code execution (ACE) or sensitive information exposure.

Business Impact

The ability to overwrite arbitrary files is a high-impact flaw that typically leads to complete system compromise. With a CVSS score of 9.0, a successful exploit could allow an attacker to gain a persistent foothold on the device, steal user data, or pivot to other systems on the network. This represents a significant risk to both individual user privacy and corporate network security.

Remediation Plan

Immediate Action: Users should immediately update the Cast to TV Screen Mirroring application to the latest available version provided by UXGROUP LLC.

Proactive Monitoring: Monitor device file systems for unauthorized changes to application directories and review system logs for unusual process executions following file imports.

Compensating Controls: Restrict application permissions to the minimum necessary for operation and avoid importing files from untrusted or unknown sources until the software is patched.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 31, 2026, there is no public information indicating active exploitation of this vulnerability. However, file overwrite vulnerabilities are a well-known vector for achieving code execution, making this a high-priority target for attackers.

Analyst Recommendation

The potential for arbitrary code execution necessitates an immediate response. We strongly recommend that all users of the Cast to TV Screen Mirroring application update to a secure version immediately. Organizations should also consider mobile device management (MDM) policies to ensure third-party applications are kept current.

---METADATA---
VENDOR: Gardyn (Infor)
PRODUCT: Gardyn
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A critical vulnerability in a Gardyn endpoint allows unauthenticated access to all registered user account information. This flaw permits total data exposure without valid credentials.

Executive Summary:
An unauthenticated data exposure vulnerability in Gardyn products allows unauthorized actors to access sensitive account information for all registered users, posing a severe privacy risk.

Vulnerability Details

CVE-ID: CVE-2026-28766

Affected Software: Gardyn (Infor)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a specific endpoint that fails to enforce authentication, exposing all user account data. An unauthenticated attacker can query this endpoint to retrieve sensitive information belonging to the entire user base.

Business Impact

The exposure of all registered user data represents a catastrophic failure of privacy controls, potentially leading to identity theft, massive reputational damage, and legal penalties. With a CVSS score of 9.3, this critical flaw indicates that the technical barrier to exploitation is low while the impact on data confidentiality is absolute. Failure to address this could result in a total loss of customer trust and significant business disruption.

Remediation Plan

Immediate Action: Update all affected Infor and Gardyn software to the latest available versions immediately to close the insecure endpoint.

Proactive Monitoring: Review web server and access logs for unusual traffic patterns directed at user profile or account management endpoints.

Compensating Controls: Implement a Web Application Firewall (WAF) to block unauthorized requests to sensitive API endpoints until the patch can be fully deployed.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Apr 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the sensitivity of the exposed data, the potential for exploitation is extremely high.

Analyst Recommendation

The severity of this unauthenticated data exposure cannot be overstated. Organizations must prioritize the application of the vendor-provided patch immediately. Given the 9.3 CVSS score, this should be treated as a top-priority remediation effort to prevent a massive data breach.

---METADATA---
VENDOR: Red Hat
PRODUCT: Undertow (JBoss EAP / Apache Camel / Data Grid / Fuse / Process Automation / SSO)
AFFECTED_VERSIONS: Red Hat Undertow; Red Hat JBoss Enterprise Application Platform 7.0.0 and 8.0.0; Red Hat Build of Apache Camel - Hawtio 4.0; Red Hat Build of Apache Camel for Spring Boot 4.0; Red Hat Data Grid 8.0; Red Hat Fuse 7.0.0; Red Hat Process Automation 7.0; Red Hat Single Sign-On 7.0; Red Hat JBoss Enterprise Application Platform Expansion Pack; Red Hat Enterprise Linux 9.0
---END_METADATA---

Description Summary:
A request smuggling vulnerability in Red Hat Undertow allows attackers to bypass authentication and access restricted information by exploiting inconsistent HTTP header processing.

Executive Summary:
An authentication bypass flaw in Red Hat Undertow, caused by improper HTTP request header handling, allows attackers to manipulate requests and gain unauthorized access.

Vulnerability Details

CVE-ID: CVE-2026-28369

Affected Software: Red Hat Undertow and related enterprise products

Affected Versions: See individual product versions listed in the metadata above.

Vulnerability: This is an authentication bypass vulnerability stemming from request smuggling. The Undertow server incorrectly strips leading whitespace from HTTP header lines instead of rejecting malformed input, allowing attackers to manipulate request interpretation.

Business Impact

With a CVSS score of 8.7, this flaw poses a severe risk to enterprise environments. Successful exploitation allows unauthorized parties to bypass security controls, access sensitive information, or manipulate web caches, potentially leading to widespread data exposure and loss of confidentiality across the affected JBoss and Red Hat ecosystems.

Remediation Plan

Immediate Action: Apply the vendor-provided security patches for all affected Red Hat product versions immediately.

Proactive Monitoring: Inspect web server logs for irregular HTTP request structures or attempts to smuggle headers that deviate from standard protocol compliance.

Compensating Controls: Utilize a hardened reverse proxy or load balancer that enforces strict HTTP request validation to mitigate request smuggling attempts before they reach the backend server.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant architectural risk due to its potential to bypass core authentication mechanisms. Security teams must audit their environments to identify all instances of the affected Red Hat software and prioritize patching to eliminate the underlying request smuggling vector.

---METADATA---
VENDOR: iccDEV
PRODUCT: ICC Color Management Libraries
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the iccDEV color management libraries could allow an attacker to execute arbitrary code by processing a specially crafted ICC profile.

Executive Summary:
The iccDEV libraries are affected by a high-severity vulnerability that enables arbitrary code execution through the manipulation of ICC color management profiles.

Vulnerability Details

CVE-ID: CVE-2026-25584

Affected Software: iccDEV Libraries and Tools

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability involves a flaw in the iccDEV libraries' handling of ICC color management profiles. An unauthenticated attacker can exploit this by delivering a malicious profile to an application, triggering an internal error that allows for memory corruption and subsequent code execution.

Business Impact

The compromise of a core library used for image processing can lead to the widespread exposure of corporate assets. If exploited, this could result in the loss of sensitive data, unauthorized system access, and significant operational disruption. The CVSS score of 7.8 highlights the High severity and the urgent need for remediation to protect the software supply chain.

Remediation Plan

Immediate Action: Update all iccDEV libraries and tools to the latest version immediately to patch the profile parsing logic.

Proactive Monitoring: Monitor for unusual application behavior when processing images and review security logs for signs of memory corruption exploits.

Compensating Controls: Employ application whitelisting and use modern operating systems with advanced memory protections to mitigate the impact of potential exploits.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. The risk remains high as long as vulnerable versions of the library are in use across various software ecosystems.

Analyst Recommendation

The primary recommendation is to apply the vendor's patch without delay. Security administrators should conduct a thorough audit of their software inventory to identify and update any third-party applications that utilize the iccDEV libraries.

---METADATA---
VENDOR: zhanghuanhao
PRODUCT: LibrarySystem
AFFECTED_VERSIONS: Up to and including version 1
---END_METADATA---

Description Summary:
A high-severity vulnerability exists in the zhanghuanhao LibrarySystem through version 1, potentially allowing for unauthorized system access.

Executive Summary:
The zhanghuanhao LibrarySystem is affected by a high-severity vulnerability that could lead to unauthorized access or data compromise within the management system.

Vulnerability Details

CVE-ID: CVE-2026-2549

Affected Software: zhanghuanhao LibrarySystem (图书馆管理系统)

Affected Versions: Up to 1

Vulnerability: The vulnerability affects the LibrarySystem management software. Although the specific CWE is not detailed, the CVSS score of 7.3 suggests a critical flaw, potentially involving improper access control or input validation that an unauthenticated or low-privileged attacker could exploit.

Business Impact

A successful exploit could result in the unauthorized disclosure of library user data, modification of system records, or potential downtime for the library services. The severity score of 7.3 indicates that this flaw could significantly impact the operational integrity of the affected institution.

Remediation Plan

Immediate Action: Discontinue use of version 1 or apply any available security patches from the developer, zhanghuanhao, immediately.

Proactive Monitoring: Review web server and application logs for unusual POST requests or SQL injection patterns targeting the LibrarySystem's administrative interfaces.

Compensating Controls: Place the application behind a Web Application Firewall (WAF) with rules configured to block common exploit payloads and restrict access to the management interface to authorized IP addresses only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 17, 2026, there is no public information indicating active exploitation. The lack of detailed documentation for this product increases the risk of undiscovered flaws.

Analyst Recommendation

Given the high severity and the potential for unauthorized access, organizations using this software should prioritize remediation. If a patch is unavailable, consider migrating to a more modern and actively supported library management platform to ensure long-term security.

---METADATA---
VENDOR: OpenEMR
PRODUCT: OpenEMR
AFFECTED_VERSIONS: Prior to version 8.0.0
---END_METADATA---

Description Summary:
An SQL injection vulnerability in the OpenEMR Patient REST API allows authenticated users to execute arbitrary queries and access protected health information.

Executive Summary:
A critical SQL injection vulnerability in OpenEMR allows authenticated users to bypass security controls and access sensitive patient data, leading to a major breach of PHI.

Vulnerability Details

CVE-ID: CVE-2026-24908

Affected Software: OpenEMR OpenEMR

Affected Versions: Prior to version 8.0.0

Vulnerability: The vulnerability exists in the Patient REST API endpoint due to the lack of proper validation on the _sort parameter. An authenticated attacker with API access can inject malicious SQL commands into the ORDER BY clause, enabling unauthorized database interaction.

Business Impact

The impact of this flaw is severe, potentially resulting in the full exposure of Protected Health Information (PHI) and a violation of HIPAA regulations. Beyond data theft, attackers could compromise administrative credentials or manipulate medical records, leading to significant legal, financial, and reputational damage. The CVSS score of 9.9 underscores the critical nature of this injection flaw.

Remediation Plan

Immediate Action: Administrators must upgrade OpenEMR installations to version 8.0.0 or higher to eliminate the vulnerable code path in the REST API.

Proactive Monitoring: Review database logs for anomalous queries containing SQL keywords in the ORDER BY clauses and monitor API traffic for suspicious sorting requests.

Compensating Controls: Deploy a Web Application Firewall (WAF) with SQL injection detection rules to intercept and block malicious payloads targeting the REST API endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 25, 2026, there is no public information indicating active exploitation of this vulnerability. Given that OpenEMR is widely used in healthcare, the incentive for exploitation by threat actors is high.

Analyst Recommendation

Protecting patient data is a primary requirement for healthcare providers. Organizations using OpenEMR must prioritize this update immediately to prevent unauthorized access to sensitive medical databases and ensure regulatory compliance.

---METADATA---
VENDOR: Lantronix
PRODUCT: EDS3000PS
AFFECTED_VERSIONS: 3.1.0.0R2
CONFIDENCE: high
MISSING: patch, exploit_status
---END_METADATA---

Description Summary:
The Lantronix EDS3000PS v.3.1.0.0R2 contains a vulnerability in the ltrx_evo component that allows remote attackers to execute arbitrary code and access sensitive information.

Executive Summary:
The Lantronix EDS3000PS device is vulnerable to remote code execution, posing a critical risk of total system compromise.

Vulnerability Details

CVE-ID: CVE-2025-70082

Affected Software: Lantronix EDS3000PS

Affected Versions: 3.1.0.0R2

Vulnerability: This vulnerability resides in the ltrx_evo component, which fails to properly sanitize inputs, allowing an unauthenticated attacker to execute arbitrary code and retrieve sensitive data.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a critical threat to organizational integrity. Successful exploitation allows an attacker to gain full control over the device, potentially leading to unauthorized data exfiltration, lateral movement within the network, and significant operational disruption.

Remediation Plan

Immediate Action: Update the Lantronix EDS3000PS firmware to the latest available vendor-supplied version immediately.

Proactive Monitoring: Monitor device access logs for unusual ltrx_evo component activity and investigate any unexpected outbound network traffic originating from the device.

Compensating Controls: Implement strict network segmentation and apply access control lists (ACLs) to limit access to the device management interface to trusted administrative IP addresses only.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of March 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly severe and requires immediate attention to prevent unauthorized access. Administrators should prioritize patching the affected firmware versions to eliminate the code execution vector and secure the device environment.

---METADATA---
VENDOR: Bareiron
PRODUCT: p2r3
AFFECTED_VERSIONS: Commit 8e4d40
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The p2r3 Bareiron component is vulnerable to an out-of-bounds memory access error, potentially leading to information disclosure or service disruption.

Executive Summary:
An unauthenticated out-of-bounds memory access vulnerability in Bareiron p2r3 allows remote attackers to trigger a Denial of Service or access sensitive memory regions.

Vulnerability Details

CVE-ID: CVE-2025-69808

Affected Software: Bareiron p2r3

Affected Versions: Commit 8e4d40

Vulnerability: The vulnerability exists as an out-of-bounds memory access issue triggered by the processing of a specially crafted network packet. Because the flaw is reachable by unauthenticated attackers, it presents a significant remote attack vector.

Business Impact

Successful exploitation allows an attacker to crash the service, resulting in operational downtime, or potentially leak sensitive information stored in memory. With a CVSS score of 9.1, this vulnerability represents a major risk to service availability and data confidentiality, particularly for systems exposed to untrusted networks.

Remediation Plan

Immediate Action: Identify systems running the affected commit (8e4d40) and restrict network access to these components until a vendor-supplied patch is available.

Proactive Monitoring: Monitor network traffic for malformed packets or unusual traffic patterns targeting the p2r3 component.

Compensating Controls: Deploy a network-level firewall or Intrusion Prevention System (IPS) to filter suspicious traffic and block malformed packets before they reach the service.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Mar 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly severe due to its unauthenticated nature and the potential for memory corruption. Organizations should prioritize isolating affected systems and tracking the vendor's security disclosures for the release of an official patch.

---METADATA---
VENDOR: Xpoda Türkiye Information Technology Inc.
PRODUCT: Xpoda Studio
AFFECTED_VERSIONS: Through 09022026
---END_METADATA---

Description Summary:
Xpoda Studio is vulnerable to SQL injection due to improper neutralization of special elements, potentially allowing unauthorized database access and manipulation.

Executive Summary:
A critical SQL injection vulnerability in Xpoda Studio allows attackers to execute unauthorized database commands, threatening the confidentiality and integrity of all stored data.

Vulnerability Details

CVE-ID: CVE-2025-6830

Affected Software: Xpoda Studio

Affected Versions: Through 09022026

Vulnerability: The application fails to properly sanitize user-supplied input before using it in SQL queries. This allows an attacker to "inject" malicious SQL code, which the database then executes, potentially bypassing authentication or extracting data.

Business Impact

A CVSS score of 9.8 reflects the high probability of a full data breach. Attackers can read sensitive tables, modify application logic by changing database values, or even gain administrative access to the server if the database is misconfigured. The vendor's lack of response to the disclosure increases the risk for users.

Remediation Plan

Immediate Action: Since the vendor has not responded, administrators should attempt to update to the latest version and contact the vendor for a specific fix.

Proactive Monitoring: Enable deep packet inspection on your WAF to detect and block SQL injection patterns (e.g., UNION SELECT, OR 1=1).

Compensating Controls: Ensure the database user for Xpoda Studio has the most restrictive permissions possible (least privilege) and use a database firewall to monitor for anomalous queries.

Exploitation Status

Public Exploit Available: false

Analyst Notes: The vendor was contacted but did not respond. This "silent" status often means a patch may not be readily available, significantly increasing the risk to current users.

Analyst Recommendation

Given the lack of vendor engagement and the 9.8 CVSS score, organizations should consider the software high-risk. If a patch is not available, consider isolating the application from the internet or moving to a secured alternative until a fix is confirmed.

---METADATA---
VENDOR: n8n
PRODUCT: n8n Workflow Automation Platform
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the n8n open-source workflow automation platform could allow for unauthorized access or execution. The flaw affects the core automation engine and its handling of workflow data.

Executive Summary:
The n8n workflow automation platform contains a high-severity vulnerability that could permit an attacker to interfere with automated business processes and sensitive data integrations.

Vulnerability Details

CVE-ID: CVE-2025-61917

Affected Software: n8n n8n

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The n8n platform, used for connecting various SaaS applications, suffers from a vulnerability in its workflow processing logic. While the specific authentication requirement is not explicitly stated, vulnerabilities in such platforms often involve the risk of unauthenticated attackers triggering workflows or accessing execution logs.

Business Impact

The impact of this vulnerability is significant due to n8n's role in handling sensitive API keys and cross-platform data. A CVSS score of 7.7 reflects a High severity risk where an exploit could lead to data exfiltration, unauthorized execution of business logic, and the compromise of connected third-party services, resulting in substantial operational and reputational damage.

Remediation Plan

Immediate Action: Update the n8n instance to the latest stable version immediately to address the underlying vulnerability in the workflow engine.

Proactive Monitoring: Audit execution logs for any unauthorized workflow triggers or anomalous data transfers to unknown external endpoints.

Compensating Controls: Deploy the n8n instance behind a VPN or use a Web Application Firewall (WAF) to restrict access to the management interface to trusted IP addresses only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. Given the increasing popularity of low-code automation tools, this platform is a high-value target for attackers seeking to pivot into cloud environments.

Analyst Recommendation

Given the High severity and the critical nature of automation platforms in modern business operations, organizations must prioritize this patch. Failure to secure n8n instances could expose the entire interconnected software ecosystem of the enterprise to unauthorized access.

---METADATA---
VENDOR: Chamilo
PRODUCT: Chamilo LMS
AFFECTED_VERSIONS: Prior to version 1.11.34
---END_METADATA---

Description Summary:
Chamilo LMS prior to 1.11.34 contains a stored XSS vulnerability in the learning path Settings field, allowing low-privileged trainers to hijack administrator accounts.

Executive Summary:
A critical stored cross-site scripting (XSS) vulnerability in Chamilo LMS allows authenticated attackers to escalate privileges and take over administrator accounts via malicious JavaScript injection.

Vulnerability Details

CVE-ID: CVE-2025-59542

Affected Software: Chamilo LMS

Affected Versions: Prior to version 1.11.34

Vulnerability: An authenticated attacker with "trainer" or similar low-level privileges can inject malicious JavaScript into the "course learning path Settings" field. When an administrator or another user views the course information page, the script executes, enabling the exfiltration of sensitive session tokens.

Business Impact

With a CVSS score of 9.0, this vulnerability presents a high risk of account takeover (ATO). A successful attack against an administrator results in full control over the Learning Management System, including access to student records, proprietary course materials, and the ability to modify site-wide configurations.

Remediation Plan

Immediate Action: Update Chamilo LMS to version 1.11.34 or later to address the insufficient input sanitization in the learning path settings.

Proactive Monitoring: Inspect the database for scripts or unusual HTML tags within the course learning path tables and monitor for anomalous administrative logins from unrecognized IP addresses.

Compensating Controls: Implement a robust Content Security Policy (CSP) to prevent the execution of inline scripts and restrict the domains from which external scripts can be loaded.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation. However, stored XSS in administrative interfaces is a common vector for internal privilege escalation.

Analyst Recommendation

Organizations using Chamilo LMS should apply the 1.11.34 patch immediately. Furthermore, security teams should educate course creators on secure content practices and consider implementing multi-factor authentication (MFA) to mitigate the impact of stolen session cookies.

---METADATA---
VENDOR: Emit Informatics and Communication Technologies Industry and Trade Ltd. Co.
PRODUCT: DIGITA Efficiency Management System
AFFECTED_VERSIONS: Through 03022026
---END_METADATA---

Description Summary:
The DIGITA Efficiency Management System is vulnerable to a critical SQL Injection flaw. An unauthenticated attacker can execute arbitrary SQL commands to manipulate or extract sensitive data.

Executive Summary:
A critical SQL Injection vulnerability in the DIGITA Efficiency Management System allows unauthenticated attackers to gain unauthorized access to the underlying database and compromise system integrity.

Vulnerability Details

CVE-ID: CVE-2025-5319

Affected Software: Emit Informatics DIGITA Efficiency Management System

Affected Versions: All versions through February 3, 2026

Vulnerability: The application fails to properly neutralize special elements used in SQL commands. This allows an unauthenticated remote attacker to inject malicious SQL queries into vulnerable parameters, potentially leading to unauthorized data retrieval or administrative access.

Business Impact

A successful exploit could lead to the total compromise of the application's database, resulting in the theft of proprietary business data, user credentials, and operational records. Given the CVSS score of 9.8, the impact is categorized as Critical, posing a high risk of permanent data loss, regulatory non-compliance, and significant reputational damage.

Remediation Plan

Immediate Action: Users should contact the vendor for a definitive patch; however, as the vendor has been unresponsive, organizations should consider migrating to a supported platform or implementing strict input filtering.

Proactive Monitoring: Monitor database logs for unusual query patterns, such as "UNION SELECT" statements or attempts to access system tables (e.g., information_schema).

Compensating Controls: Deploy a Web Application Firewall (WAF) with SQL injection protection rules to intercept and block malicious payloads targeting the DIGITA web interface.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, the vendor's lack of response suggests that no official patch may be forthcoming, increasing the window of risk for current users.

Analyst Recommendation

The severity of this SQL Injection vulnerability cannot be overstated, especially given the lack of vendor communication. Organizations must prioritize the implementation of compensating controls, such as a WAF, and evaluate the long-term viability of the product. Immediate isolation of the database from direct external access is mandatory.

---METADATA---
VENDOR: Tegsoft
PRODUCT: Online Support Application
AFFECTED_VERSIONS: V3 through 31122025
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A reflected cross-site scripting (XSS) vulnerability in the Tegsoft Online Support Application allows attackers to execute arbitrary scripts in a user's browser.

Executive Summary:
The Tegsoft Online Support Application is vulnerable to reflected XSS, which could allow attackers to execute malicious scripts against users of the platform.

Vulnerability Details

CVE-ID: CVE-2025-14320

Affected Software: Tegsoft Online Support Application

Affected Versions: V3 through 31122025

Vulnerability: The application fails to properly neutralize user-supplied input during web page generation, leading to a reflected XSS vulnerability. This allows an attacker to inject malicious JavaScript into a URL or request, which is then executed in the context of the victim's session.

Business Impact

A CVSS score of 9.8 indicates a critical risk, as XSS can be used to hijack user sessions, steal sensitive session cookies, or redirect users to malicious sites. This compromise can lead to full account takeover and unauthorized access to support data, resulting in significant reputational and operational harm.

Remediation Plan

Immediate Action: Consult the vendor for the latest security release or patch addressing input neutralization in the Online Support Application.

Proactive Monitoring: Monitor web server logs for suspicious URL parameters containing script tags or encoded characters typical of XSS payloads.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured with rules to detect and block common cross-site scripting attack patterns.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of May 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Reflected XSS is a common but dangerous vector. Users of the Tegsoft Online Support Application should restrict access to the affected web interfaces until a patch is applied and verify that all user inputs are properly sanitized by the application framework.

---METADATA---
VENDOR: NTN Information Processing Services
PRODUCT: Smart Panel
AFFECTED_VERSIONS: before 20251215
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
An unrestricted file upload vulnerability in NTN Smart Panel allows unauthenticated attackers to bypass access controls and execute arbitrary functionality.

Executive Summary:
A critical file upload vulnerability in NTN Smart Panel permits unauthenticated access to restricted functions, posing a severe risk of system compromise.

Vulnerability Details

CVE-ID: CVE-2025-14014

Affected Software: NTN Information Processing Services Smart Panel

Affected Versions: before 20251215

Vulnerability: This vulnerability involves the unrestricted upload of dangerous file types, which allows an unauthenticated attacker to bypass established Access Control Lists (ACLs) and interact with restricted system functions.

Business Impact

The ability for an unauthenticated user to upload arbitrary files and bypass ACLs constitutes a critical security failure. With a CVSS score of 9.8, this vulnerability could lead to full system takeover, unauthorized data exfiltration, or the deployment of persistent malicious software, resulting in significant operational downtime and reputational damage.

Remediation Plan

Immediate Action: Upgrade Smart Panel to version 20251215 or later immediately to restrict unauthorized file uploads and enforce proper ACL validation.

Proactive Monitoring: Inspect web server logs for suspicious file upload patterns, particularly those originating from unknown or unauthorized IP addresses, and monitor for unauthorized access to administrative endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict file extension and content-type filtering to block malicious uploads until the patch can be applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Feb 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this flaw and the lack of authentication required for exploitation, organizations must prioritize patching. Failure to remediate this vulnerability leaves the environment exposed to remote code execution and full administrative compromise.

---METADATA---
VENDOR: Infor
PRODUCT: Multiple Products
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: versions, patch
---END_METADATA---

Description Summary:
Infor products using a vulnerable third-party Velocity template engine are susceptible to arbitrary template code execution by an authenticated administrator.

Executive Summary:
A critical vulnerability in Infor products allows an authenticated administrator to execute arbitrary template code, potentially leading to full remote code execution on the underlying server.

Vulnerability Details

CVE-ID: CVE-2025-12107

Affected Software: Infor Multiple Products

Affected Versions: See vendor advisory

Vulnerability: The vulnerability stems from the use of an outdated third-party Velocity template engine, allowing an authenticated administrator to inject and execute arbitrary server-side template syntax.

Business Impact

Successful exploitation allows an attacker already possessing administrative credentials to escalate their impact to remote code execution. This could result in complete server compromise, unauthorized data exfiltration, or the installation of persistent backdoors, justifying the critical CVSS score of 10.0.

Remediation Plan

Immediate Action: Update all affected Infor products to the latest available version as specified by the vendor’s security advisory.

Proactive Monitoring: Audit administrative activity logs for unexpected template modifications or unauthorized execution of system-level commands.

Compensating Controls: Implement the principle of least privilege for administrative accounts and utilize file integrity monitoring (FIM) to detect unauthorized changes to server-side templates.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Feb 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

While this exploit requires administrative privileges, the potential for total system compromise is extreme. Administrators must prioritize applying vendor-supplied updates to replace the vulnerable template engine and mitigate the risk of remote code execution.

---METADATA---
VENDOR: Infor
PRODUCT: Multiple Products
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A permissions issue in multiple Infor products has been addressed with additional restrictions to prevent unauthorized access.

Executive Summary:
Multiple Infor products are affected by a high-severity permissions vulnerability that could allow unauthorized users to access restricted resources or functions.

Vulnerability Details

CVE-ID: CVE-2024-44219

Affected Software: Infor Multiple Products

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability involves a permissions issue where access controls were insufficiently enforced. An authenticated user could potentially exploit this flaw to bypass intended restrictions and gain access to sensitive data or administrative capabilities.

Business Impact

The inability to properly enforce permissions can lead to unauthorized data disclosure and privilege escalation. With a CVSS score of 7.5, this high-severity vulnerability could result in the compromise of sensitive business information and the loss of data integrity, potentially leading to regulatory non-compliance and financial loss.

Remediation Plan

Immediate Action: Apply the vendor-provided security updates immediately to implement the necessary permission restrictions.

Proactive Monitoring: Review user access logs and permission change history for any signs of unauthorized activity or privilege escalation attempts.

Compensating Controls: Enforce the principle of least privilege (PoLP) across all Infor applications to minimize the impact of any single account compromise.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation of this vulnerability. This is a late disclosure of a 2024 vulnerability, emphasizing the need to ensure all legacy systems are patched.

Analyst Recommendation

Organizations using Infor products must prioritize the application of these security updates. Strengthening access controls is a fundamental security requirement, and this patch is critical to preventing unauthorized lateral movement within the application.

---METADATA---
VENDOR: Edimax
PRODUCT: EW-7438RPn
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A security vulnerability exists in the Edimax EW-7438RPn range extender that could allow for unauthorized access or system compromise.

Executive Summary:
The Edimax EW-7438RPn range extender contains a high-severity vulnerability that could allow an attacker to compromise the device and intercept network traffic.

Vulnerability Details

CVE-ID: CVE-2020-37097

Affected Software: Edimax EW-7438RPn

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability affects the Edimax EW-7438RPn hardware. While technical specifics are limited in the late disclosure, the high CVSS score suggests a critical failure in the device's management interface or network stack, likely exploitable by an unauthenticated attacker on the local network.

Business Impact

A successful exploit of this range extender could lead to a complete compromise of the local network infrastructure. Attackers could perform man-in-the-middle (MitM) attacks, redirecting or capturing sensitive data transmitted by connected users. With a CVSS score of 7.5, the risk to confidentiality and integrity is significant, potentially leading to the exposure of corporate credentials or internal communications.

Remediation Plan

Immediate Action: Administrators should immediately check for and apply the latest firmware updates from the Edimax support portal to mitigate this flaw.

Proactive Monitoring: Monitor network traffic originating from IoT and networking hardware for unusual outbound connections or unauthorized configuration changes.

Compensating Controls: Isolate range extenders and similar networking hardware on a dedicated management VLAN with strict access control lists (ACLs) to prevent lateral movement.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and its late disclosure, the potential for exploitation remains a high priority for organizations using legacy networking hardware.

Analyst Recommendation

The high severity of this vulnerability necessitates immediate remediation. Organizations should prioritize updating the firmware on all Edimax EW-7438RPn devices or consider replacing end-of-life hardware that no longer receives security patches to maintain a robust security posture.

---METADATA---
VENDOR: EspoCRM
PRODUCT: EspoCRM
AFFECTED_VERSIONS: 5.8.5
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
EspoCRM 5.8.5 is vulnerable to an authentication bypass via manipulation of authorization headers, allowing unauthorized access to administrative user information and privileges.

Executive Summary:
A critical authentication vulnerability in EspoCRM 5.8.5 allows unauthenticated attackers to hijack user accounts and escalate privileges to administrative levels.

Vulnerability Details

CVE-ID: CVE-2020-37094

Affected Software: EspoCRM

Affected Versions: 5.8.5

Vulnerability: This vulnerability involves the improper handling of Basic Authorization and Espo-Authorization tokens. Attackers can decode and modify these headers to bypass authentication mechanisms and impersonate other users, including administrators.

Business Impact

The ability for an attacker to gain unauthorized administrative access poses a severe threat to data integrity, confidentiality, and system availability. Given the CVSS score of 9.8, this vulnerability could lead to total system compromise, theft of sensitive customer data, and unauthorized modification of business records.

Remediation Plan

Immediate Action: Upgrade to the latest available version of EspoCRM provided by the vendor to remediate the header manipulation flaw.

Proactive Monitoring: Review application access logs for anomalous authorization header patterns or unauthorized access attempts to administrative endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and validate authorization headers for malformed or suspicious token strings.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Feb 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a critical security risk that requires immediate attention. Organizations utilizing EspoCRM 5.8.5 should prioritize patching to the latest version to prevent unauthorized administrative access and potential data exfiltration.

---METADATA---
VENDOR: Netis
PRODUCT: E1+ Range Extender
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A vulnerability in the Netis E1+ 1 range extender could allow for unauthorized device manipulation. This flaw is distinct from other reported issues for the same product line and affects core firmware components.

Executive Summary:
A high-severity vulnerability in the Netis E1+ 1 device could permit an attacker to take control of the networking hardware, leading to a compromise of the local network environment.

Vulnerability Details

CVE-ID: CVE-2020-37093

Affected Software: Netis E1+

Affected Versions: See vendor advisory

Vulnerability: This vulnerability affects the Netis E1+ 1. Similar to other flaws in this product line, it likely stems from improper input validation or insecure default configurations in the firmware, which could be exploited by an unauthenticated attacker with network access to the device.

Business Impact

The impact of a compromised network extender includes the potential for man-in-the-middle (MitM) attacks, data theft, and the loss of network availability. A CVSS score of 7.5 highlights the High severity of this risk, as it directly undermines the security perimeter of the organization's physical network infrastructure.

Remediation Plan

Immediate Action: Immediately update the Netis E1+ firmware to the most recent version provided by the manufacturer.

Proactive Monitoring: Perform regular audits of network device logs and monitor for unexpected firmware modifications or configuration changes.

Compensating Controls: Isolate IoT and network infrastructure devices on a separate VLAN to limit the potential impact of a device compromise on the primary corporate network.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation. This late-disclosed vulnerability (originally from 2020) emphasizes the ongoing risk posed by legacy networking hardware that may not be regularly audited for security.

Analyst Recommendation

It is critical to apply the necessary firmware updates immediately. Given the High CVSS score, any delay in remediation could leave the network vulnerable to attackers seeking to exploit unpatched infrastructure for data exfiltration or as a platform for further attacks.

---METADATA---
VENDOR: Infor
PRODUCT: Kados R10 GreenBee
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Kados R10 GreenBee is susceptible to SQL injection via the filter_user_mail parameter, allowing unauthorized database query manipulation.

Executive Summary:
The Kados R10 GreenBee application contains an SQL injection vulnerability that could lead to unauthorized database access and data compromise.

Vulnerability Details

CVE-ID: CVE-2019-25704

Affected Software: Infor Kados R10 GreenBee

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The filter_user_mail parameter is not properly sanitized, allowing attackers to inject malicious SQL commands into the application's database queries.

Business Impact

Successful exploitation could result in unauthorized access to sensitive data, leading to a significant breach. The CVSS score of 8.2 signifies a high-severity threat that requires immediate intervention from security teams.

Remediation Plan

Immediate Action: Apply the vendor-provided security patch to the affected system.

Proactive Monitoring: Review database and application logs for unusual query activity that might indicate an injection attempt.

Compensating Controls: Deploy WAF rules to detect and block SQL injection patterns in the filter_user_mail parameter.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams must prioritize patching this vulnerability to ensure the integrity of the system's data. Immediate action is required to reduce the risk of unauthorized database interaction.

---METADATA---
VENDOR: Infor
PRODUCT: Kados R10 GreenBee
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Kados R10 GreenBee is vulnerable to SQL injection via the id_project parameter, allowing attackers to manipulate database queries.

Executive Summary:
An SQL injection vulnerability in Infor Kados R10 GreenBee enables unauthorized database manipulation, posing a significant security risk.

Vulnerability Details

CVE-ID: CVE-2019-25702

Affected Software: Infor Kados R10 GreenBee

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability exists because the id_project parameter is not properly sanitized, allowing attackers to inject SQL commands into the backend database.

Business Impact

Unauthorized database interaction could lead to data theft or system compromise, causing significant harm to business operations. The CVSS score of 8.2 highlights the severity of this issue and the importance of timely remediation.

Remediation Plan

Immediate Action: Update the Kados R10 GreenBee software to the latest version provided by the vendor.

Proactive Monitoring: Monitor database query logs for suspicious activity and unauthorized access attempts.

Compensating Controls: Use a Web Application Firewall (WAF) to filter out malicious SQL injection attempts targeting the id_project parameter.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations should ensure that all security updates are applied immediately. Implementing strong database access controls and monitoring will help mitigate the potential for exploitation.

---METADATA---
VENDOR: Infor
PRODUCT: Kados R10 GreenBee
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Kados R10 GreenBee is susceptible to SQL injection via the sort_direction parameter, allowing for unauthorized database query manipulation.

Executive Summary:
An SQL injection vulnerability in Infor Kados R10 GreenBee allows attackers to execute malicious database queries, threatening data integrity.

Vulnerability Details

CVE-ID: CVE-2019-25700

Affected Software: Infor Kados R10 GreenBee

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The application fails to sanitize the sort_direction parameter, permitting attackers to inject arbitrary SQL statements. This vulnerability allows for unauthorized database interaction.

Business Impact

Exploiting this vulnerability could lead to unauthorized data access or modification, potentially causing significant business disruption. The CVSS score of 8.2 emphasizes the need for rapid remediation to protect organizational assets.

Remediation Plan

Immediate Action: Apply the vendor-supplied security patch to the affected system.

Proactive Monitoring: Monitor for anomalous query patterns in database logs and review system access logs for suspicious activity.

Compensating Controls: Deploy WAF rules to block malicious SQL injection payloads targeting the sort_direction parameter.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should prioritize patching this vulnerability to prevent potential unauthorized database access. Consistent with high-severity vulnerabilities, immediate action is recommended.

---METADATA---
VENDOR: Infor
PRODUCT: Kados R10 GreenBee
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Kados R10 GreenBee contains an SQL injection vulnerability in the id_to_delete parameter, enabling unauthorized database query manipulation.

Executive Summary:
The Kados R10 GreenBee application is vulnerable to SQL injection, which could allow an attacker to maliciously modify or delete database records.

Vulnerability Details

CVE-ID: CVE-2019-25698

Affected Software: Infor Kados R10 GreenBee

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The id_to_delete parameter is not properly sanitized, allowing attackers to inject SQL commands into the application's database queries. This vulnerability allows for unauthorized data manipulation.

Business Impact

Successful exploitation could result in the loss of data or unauthorized access to system records, leading to significant disruption. The CVSS score of 8.2 indicates a high-severity threat that requires immediate attention from security teams.

Remediation Plan

Immediate Action: Update the Kados R10 GreenBee software to the latest version as directed by the vendor.

Proactive Monitoring: Review database logs for suspicious delete or modification commands that do not align with standard user behavior.

Compensating Controls: Use a Web Application Firewall (WAF) to detect and block malicious SQL injection strings in the id_to_delete parameter.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Prompt remediation is necessary to ensure the integrity of the application's database. IT administrators should verify that all patches are applied to eliminate the risk of exploitation.

---METADATA---
VENDOR: Infor
PRODUCT: Kados R10 GreenBee
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Kados R10 GreenBee contains an SQL injection vulnerability in the language_tag parameter, allowing attackers to manipulate database queries.

Executive Summary:
An SQL injection vulnerability in Infor Kados R10 GreenBee allows unauthorized database manipulation through the language_tag parameter.

Vulnerability Details

CVE-ID: CVE-2019-25696

Affected Software: Infor Kados R10 GreenBee

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The application improperly handles the language_tag parameter, which is used in database queries. This flaw allows an attacker to inject malicious SQL commands, potentially resulting in unauthorized data access.

Business Impact

Exploitation of this flaw could lead to data exfiltration or unauthorized database modification, impacting business operations and data security. The CVSS score of 8.2 reflects the high severity and the potential for significant impact on the organization.

Remediation Plan

Immediate Action: Apply the vendor-recommended security updates to fix the input validation vulnerability.

Proactive Monitoring: Monitor for suspicious activity in application logs and ensure database query logging is enabled.

Compensating Controls: Deploy WAF rules to inspect traffic for SQL injection attempts specifically targeting the language_tag parameter.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations should prioritize applying the vendor-provided patch to mitigate this risk. Regular auditing of database access is recommended to ensure no unauthorized activity occurs.

---METADATA---
VENDOR: Infor
PRODUCT: Kados R10 GreenBee
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Kados R10 GreenBee is vulnerable to unauthenticated SQL injection via the user2reset parameter, facilitating unauthorized database interaction.

Executive Summary:
An unauthenticated SQL injection vulnerability in Infor Kados R10 GreenBee poses a critical risk to data confidentiality and database stability.

Vulnerability Details

CVE-ID: CVE-2019-25694

Affected Software: Infor Kados R10 GreenBee

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The application fails to perform sufficient input validation on the user2reset parameter, permitting unauthenticated attackers to execute arbitrary SQL commands. This allows for direct interaction with the backend database.

Business Impact

The ability for an unauthenticated attacker to manipulate database queries poses a severe risk, including the potential for complete database compromise. With a CVSS score of 8.2, this vulnerability is a high-priority threat that could lead to widespread data loss or unauthorized access.

Remediation Plan

Immediate Action: Immediately apply the latest security updates or patches provided by the vendor.

Proactive Monitoring: Review security logs for suspicious database queries and monitor for unusual traffic spikes associated with the user2reset function.

Compensating Controls: Utilize a Web Application Firewall (WAF) to sanitize inputs and block requests containing SQL injection patterns directed at the user2reset parameter.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the unauthenticated nature of this vulnerability, it constitutes a significant risk. Remediation should be treated as a high priority to prevent potential exploitation by malicious actors.

---METADATA---
VENDOR: Infor
PRODUCT: Kados R10 GreenBee
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Kados R10 GreenBee is susceptible to SQL injection via the 'id_to_modify' parameter, allowing unauthorized database query manipulation.

Executive Summary:
The Kados R10 GreenBee platform suffers from an SQL injection vulnerability that could allow unauthorized modification or exfiltration of database records.

Vulnerability Details

CVE-ID: CVE-2019-25692

Affected Software: Infor Kados R10 GreenBee

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability occurs because the 'id_to_modify' parameter is not adequately sanitized before being used in database queries. This flaw allows an attacker to inject SQL commands, potentially altering database content.

Business Impact

Exploitation of this vulnerability could lead to the unauthorized modification of critical business data, resulting in significant operational disruption and loss of data integrity. With a CVSS score of 8.2, this issue presents a high-level risk that should be addressed immediately.

Remediation Plan

Immediate Action: Apply the vendor-supplied security patch to the Kados R10 GreenBee application.

Proactive Monitoring: Monitor database query logs for unexpected modification commands or unauthorized access to sensitive tables.

Compensating Controls: Implement WAF rules to inspect incoming traffic and block requests containing malicious SQL payloads in the 'id_to_modify' field.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams must prioritize the application of vendor updates to remediate this SQL injection flaw. Failure to act may expose the organization to data integrity risks and potential regulatory non-compliance.

---METADATA---
VENDOR: Infor
PRODUCT: Kados R10 GreenBee
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Kados R10 GreenBee contains an SQL injection vulnerability in the mng_profile_id parameter, enabling attackers to manipulate database queries.

Executive Summary:
An SQL injection vulnerability in Infor Kados R10 GreenBee exposes the backend database to unauthorized manipulation and potential data breach.

Vulnerability Details

CVE-ID: CVE-2019-25690

Affected Software: Infor Kados R10 GreenBee

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The application fails to properly sanitize the mng_profile_id parameter, allowing an attacker to inject arbitrary SQL statements. This vulnerability requires authenticated access to the specific interface, though the risk remains high due to the potential for privilege escalation.

Business Impact

A successful exploit could allow an attacker to bypass authentication or extract sensitive profile data from the database. The CVSS score of 8.2 underscores the severity, necessitating prompt remediation to avoid reputational damage and unauthorized system access.

Remediation Plan

Immediate Action: Update the affected Kados R10 GreenBee installation to the latest version provided by the vendor to remediate the input validation flaw.

Proactive Monitoring: Review application and database access logs for anomalous SQL activity originating from user profiles.

Compensating Controls: Use a Web Application Firewall (WAF) to filter out requests containing suspicious SQL syntax within the mng_profile_id parameter.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The vulnerability poses a high risk to database security. IT administrators must ensure that all security patches are applied and that access controls are reviewed to limit the potential impact of a compromised account.

---METADATA---
VENDOR: Infor
PRODUCT: Kados R10 GreenBee
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Kados R10 GreenBee is vulnerable to SQL injection via the menu_lev1 parameter, allowing unauthenticated attackers to execute arbitrary database queries.

Executive Summary:
An unauthenticated SQL injection vulnerability in Infor Kados R10 GreenBee permits remote attackers to compromise database integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2019-25688

Affected Software: Infor Kados R10 GreenBee

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a classic SQL injection vulnerability occurring in the menu_lev1 parameter. The flaw is exploitable by unauthenticated remote attackers who can inject malicious SQL commands to manipulate backend database operations.

Business Impact

Successful exploitation allows unauthorized access to sensitive information stored within the database, potentially leading to full data exfiltration or unauthorized administrative modifications. With a CVSS score of 8.2 (High), this vulnerability represents a significant risk to organizational data integrity and compliance requirements.

Remediation Plan

Immediate Action: Consult the official vendor security advisory to identify and apply the necessary patches or security updates to the Kados R10 GreenBee environment.

Proactive Monitoring: Implement database query logging and monitor for unusual query patterns or syntax errors that indicate injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict input validation rules to block malicious SQL payloads targeting the menu_lev1 parameter.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the ability for unauthenticated attackers to interact directly with the database, immediate action is required. Organizations should prioritize patching or applying virtual mitigations to prevent unauthorized access to the underlying data store.

---METADATA---
VENDOR: Homey
PRODUCT: Homey BNB
AFFECTED_VERSIONS: Homey BNB V4; See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Homey BNB V4 contains an unauthenticated SQL injection vulnerability in the 'hosting_id' parameter, allowing for unauthorized database query manipulation.

Executive Summary:
An unauthenticated SQL injection vulnerability in Homey BNB V4 allows attackers to gain full access to the application's database, posing a critical risk to data privacy.

Vulnerability Details

CVE-ID: CVE-2019-25489

Affected Software: Homey Homey BNB

Affected Versions: Homey BNB V4; See vendor advisory for specific affected versions

Vulnerability: The vulnerability is an unauthenticated SQL injection flaw within the 'hosting_id' parameter of Homey BNB V4. This allows a remote attacker to bypass security controls and execute arbitrary SQL commands against the backend database without requiring any login credentials.

Business Impact

The impact of this vulnerability is severe, potentially resulting in the complete exfiltration of the database, including user information, booking details, and administrative credentials. The CVSS score of 8.2 and the unauthenticated nature of the attack elevate the urgency of this late-disclosure vulnerability.

Remediation Plan

Immediate Action: Apply the vendor-supplied patches for Homey BNB V4 immediately. If a patch is not available, consider taking the affected service offline until it can be secured.

Proactive Monitoring: Thoroughly audit database logs for evidence of past exploitation, specifically looking for unauthorized access to sensitive tables or unusual activity linked to the 'hosting_id' parameter.

Compensating Controls: Deploy a WAF with aggressive SQL injection filtering and restrict database access to the minimum required permissions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: Although this is a late disclosure of a 2019 vulnerability, the risk remains high for any legacy systems still running Homey BNB V4. The unauthenticated nature of the flaw makes it a primary target for automated scanning tools.

Analyst Recommendation

This vulnerability must be remediated with the highest priority. The ability for unauthenticated attackers to manipulate the database represents a critical failure in security that can only be resolved through immediate patching or system replacement.