---METADATA---
VENDOR: Mozilla
PRODUCT: Firefox, Thunderbird
AFFECTED_VERSIONS: Versions prior to 151
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An information disclosure vulnerability exists in the WebGPU graphics component of Mozilla Firefox and Thunderbird, potentially allowing unauthenticated remote attackers to access sensitive data.

Executive Summary:
An information disclosure vulnerability in the WebGPU component of Mozilla Firefox and Thunderbird allows remote attackers to access protected system information.

Vulnerability Details

CVE-ID: CVE-2026-8967

Affected Software: Mozilla Firefox and Thunderbird

Affected Versions: Versions prior to 151

Vulnerability: This vulnerability affects the Graphics: WebGPU component. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates that the flaw is fully automatable and does not require user interaction or authentication to exploit.

Business Impact

Successful exploitation allows unauthorized access to potentially sensitive information processed within the browser's graphics memory. With a CVSS score of 7.5, this vulnerability represents a significant risk to data confidentiality, as it could facilitate the leakage of sensitive user data or system artifacts to external actors.

Remediation Plan

Immediate Action: Update Mozilla Firefox and Mozilla Thunderbird to version 151 or later immediately to resolve the memory exposure.

Proactive Monitoring: Review web server and endpoint logs for suspicious requests directed at graphics-intensive web applications.

Compensating Controls: Use network-level filtering to block access to untrusted domains that may attempt to utilize malicious WebGPU calls.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of required user interaction makes this vulnerability particularly dangerous for automated, wide-scale scanning by remote attackers.

Analyst Recommendation

The severity of this information disclosure necessitates an immediate update. Organizations should ensure all browser instances are updated to version 151 to eliminate the risk of automated data exposure.

---METADATA---
VENDOR: Mozilla
PRODUCT: Firefox, Thunderbird
AFFECTED_VERSIONS: Versions prior to 151
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An information disclosure vulnerability exists in the IP Protection component of Mozilla Firefox and Thunderbird, potentially allowing unauthenticated remote attackers to access sensitive data.

Executive Summary:
An information disclosure flaw in the IP Protection component of Mozilla Firefox and Thunderbird enables remote attackers to access sensitive information without user interaction.

Vulnerability Details

CVE-ID: CVE-2026-8966

Affected Software: Mozilla Firefox and Thunderbird

Affected Versions: Versions prior to 151

Vulnerability: This vulnerability affects the IP Protection component, which is designed to obfuscate user network identities. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that the vulnerability is remotely exploitable without authentication or user interaction.

Business Impact

The failure of the IP Protection component can lead to the exposure of internal network configurations or user-specific metadata. Given the 7.5 CVSS score, this represents a high risk to user anonymity and organizational privacy, potentially enabling further targeted attacks by adversaries who gain visibility into internal network structures.

Remediation Plan

Immediate Action: Update Mozilla Firefox and Mozilla Thunderbird to version 151 or later to patch the IP Protection logic.

Proactive Monitoring: Monitor network traffic for unusual patterns originating from browser-based IP masking services.

Compensating Controls: Deploy enterprise-grade VPNs or secure gateways to provide additional layers of network identity protection while browsers are being updated.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Because this flaw is fully automatable, the risk of exploitation increases if the vulnerability remains unpatched in exposed browser environments.

Analyst Recommendation

The risk associated with this information disclosure is high due to the lack of required user interaction for successful exploitation. Organizations must prioritize the rollout of version 151 to ensure the integrity of the browser's privacy-protecting features.

---METADATA---
VENDOR: Mozilla
PRODUCT: Firefox, Thunderbird
AFFECTED_VERSIONS: Versions prior to 151
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An information disclosure vulnerability exists in the DOM Security component of Mozilla Firefox and Thunderbird, allowing unauthenticated attackers to potentially access sensitive information.

Executive Summary:
Mozilla Firefox and Thunderbird are affected by a DOM Security component information disclosure vulnerability that could lead to unauthorized data exposure.

Vulnerability Details

CVE-ID: CVE-2026-8965

Affected Software: Mozilla Firefox and Mozilla Thunderbird

Affected Versions: Versions prior to 151

Vulnerability: This is an information disclosure flaw located within the Document Object Model (DOM) security subsystem. The vulnerability is exploitable by an unauthenticated remote attacker via network-based vectors.

Business Impact

Successful exploitation allows an attacker to gain access to sensitive information that should be protected by the browser's security boundaries. While the CVSS score of 7.5 indicates a High severity, the impact is primarily restricted to data confidentiality, potentially leading to unauthorized access to user data or session information, which could facilitate further downstream attacks.

Remediation Plan

Immediate Action: Update Mozilla Firefox and Mozilla Thunderbird to version 151 or later immediately.

Proactive Monitoring: Monitor network traffic for unusual patterns originating from the browser and review application logs for signs of anomalous DOM-related activity.

Compensating Controls: Ensure that browser security settings are configured to minimize the execution of untrusted scripts and utilize endpoint security software to detect potential malicious memory access attempts.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's nature suggests it could be leveraged in targeted web-based attacks to exfiltrate data.

Analyst Recommendation

Given the potential for unauthorized information disclosure, organizations should prioritize updating all instances of Mozilla Firefox and Thunderbird to version 151 or later. Applying these vendor-supplied updates is the only definitive way to remediate this security risk and protect user data integrity.

---METADATA---
VENDOR: Mozilla
PRODUCT: Firefox, Thunderbird
AFFECTED_VERSIONS: Versions prior to 140.11, 140.12 through 150, and prior to 151
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A critical security flaw exists in the process sandboxing component of Mozilla Firefox and Thunderbird, enabling information disclosure and sandbox escape.

Executive Summary:
A critical sandbox escape vulnerability in Mozilla Firefox and Thunderbird allows remote attackers to bypass security boundaries and access sensitive information.

Vulnerability Details

CVE-ID: CVE-2026-8958

Affected Software: Mozilla Firefox and Mozilla Thunderbird

Affected Versions: Versions prior to 140.11, versions 140.12 through 150, and any version prior to 151.

Vulnerability: This is an information disclosure and sandbox escape vulnerability within the Process Sandboxing component. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) indicates that the vulnerability is remotely exploitable, requires no authentication, and results in a scope change with high confidentiality impact.

Business Impact

The ability to escape the browser sandbox is a severe security failure that allows attackers to potentially access data outside the browser's restricted environment. With a CVSS score of 8.6, this vulnerability poses a significant threat to organizational data security, as it facilitates unauthorized access to sensitive information on the host system.

Remediation Plan

Immediate Action: Update Mozilla Firefox and Mozilla Thunderbird to version 151 or the specified corrected version (e.g., 140.11) immediately.

Proactive Monitoring: Monitor host-level system logs for signs of unauthorized process interactions or attempts to access restricted file paths.

Compensating Controls: Use endpoint detection and response (EDR) tools to identify and block suspicious child processes spawned by the browser.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The scope-changing nature of this flaw makes it highly desirable for attackers seeking to elevate privileges or move laterally from the browser.

Analyst Recommendation

This is a critical vulnerability that requires immediate attention. Because the flaw allows for a sandbox escape, the potential for system-wide compromise is high. Administrators should deploy the required updates across all endpoints without delay to mitigate the risk of remote information disclosure.

---METADATA---
VENDOR: xiandafu
PRODUCT: beetl
AFFECTED_VERSIONS: 3.20.0, 3.20.1, 3.20.2
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A vulnerability in the xiandafu beetl template engine allows for Expression Language injection due to improper input validation, potentially leading to unauthorized code execution.

Executive Summary:
A critical Expression Language injection vulnerability in xiandafu beetl versions 3.20.0 through 3.20.2 poses a significant risk of unauthorized system interaction.

Vulnerability Details

CVE-ID: CVE-2026-8759

Affected Software: xiandafu beetl

Affected Versions: 3.20.0, 3.20.1, 3.20.2

Vulnerability: This vulnerability (CWE-917, CWE-20) involves improper neutralization of special elements used in Expression Language statements. It is remotely exploitable without authentication, allowing unauthenticated attackers to manipulate template processing.

Business Impact

Successful exploitation could allow an attacker to execute arbitrary expressions, potentially leading to unauthorized data access or disruption of application services. While the CVSS score of 7.3 reflects high impact, the lack of authentication requirements necessitates immediate prioritization to prevent potential compromise of the application environment.

Remediation Plan

Immediate Action: Review vendor documentation for available security updates or patches for the beetl library and apply them to all affected instances immediately.

Proactive Monitoring: Monitor application logs for suspicious template input patterns or unexpected execution of expression language syntax.

Compensating Controls: Implement strict input validation and sanitization at the application layer to ensure that only expected data is passed to the template engine.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 18, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its potential for remote expression evaluation.

Analyst Recommendation

The severity of this vulnerability, combined with the existence of a proof-of-concept, requires proactive risk management. Organizations utilizing the beetl template engine should prioritize identifying all affected deployments and applying vendor-provided security patches as soon as they are made available.

---METADATA---
VENDOR: fishaudio
PRODUCT: Bert-VITS2
AFFECTED_VERSIONS: 8f7fbd8c4770965225d258db548da27dc8dd934c
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A path traversal vulnerability in fishaudio Bert-VITS2 allows unauthenticated remote attackers to access unauthorized files via improper input validation.

Executive Summary:
A critical path traversal vulnerability in fishaudio Bert-VITS2 allows unauthenticated attackers to potentially read sensitive system files.

Vulnerability Details

CVE-ID: CVE-2026-8756

Affected Software: fishaudio Bert-VITS2

Affected Versions: 8f7fbd8c4770965225d258db548da27dc8dd934c

Vulnerability: The software suffers from a Path Traversal vulnerability (CWE-22) which permits unauthenticated attackers to traverse the filesystem and access files outside of the intended directory structure.

Business Impact

This vulnerability may lead to the disclosure of sensitive configuration files, source code, or internal system data, significantly increasing the risk of further system compromise. The CVSS score of 7.3 underscores the criticality of this flaw, as it allows attackers to bypass security boundaries without requiring any user credentials.

Remediation Plan

Immediate Action: Update the Bert-VITS2 implementation to the latest secure version provided by the developer and restrict directory access permissions.

Proactive Monitoring: Monitor system logs for file access requests containing directory traversal sequences such as "../" or absolute paths.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block requests containing path traversal sequences or directory navigation attempts.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 18, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. Path traversal flaws are typically trivial to weaponize once discovered.

Analyst Recommendation

Given the potential for unauthorized file access, it is imperative to secure the environment by applying the latest software updates. If an update is not immediately available, ensure that the application process is running with the least-privilege principle to limit the impact of potential file traversal attempts.

---METADATA---
VENDOR: radareorg
PRODUCT: radare2
AFFECTED_VERSIONS: 6.1.5
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A Use After Free vulnerability exists in radare2 version 6.1.5, specifically within the gdbr component, which can lead to application crashes or denial of service.

Executive Summary:
A Use After Free vulnerability in the radare2 gdbr component allows for potential denial of service attacks via malicious input.

Vulnerability Details

CVE-ID: CVE-2026-8696

Affected Software: radareorg radare2

Affected Versions: 6.1.5

Vulnerability: This is a Use After Free vulnerability (CWE-416) triggered during the processing of the gdbr pids list. The flaw allows an unauthenticated attacker to cause an application-level denial of service by triggering memory corruption.

Business Impact

The ability to crash a security analysis tool like radare2 can disrupt incident response and reverse engineering workflows. While the primary impact is a denial of service (system availability), the severity is elevated due to the nature of the tool as a security utility. The CVSS score of 7.5 reflects the potential for significant operational disruption.

Remediation Plan

Immediate Action: Apply the upstream fix provided in commit c213ad6894a1eb9086ac8bf5fae35757e9e1683c by updating to the latest development version or applying the patch.

Proactive Monitoring: Monitor logs for crashes or unexpected termination of radare2 processes when interacting with remote debugging targets.

Compensating Controls: Limit access to debugging interfaces and ensure that radare2 is only executed in isolated, sandboxed environments when processing untrusted binaries.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable as it involves memory management errors in a complex input-processing component.

Analyst Recommendation

Users of radare2 should apply the identified fix immediately to prevent potential service instability. Given the existence of a proof-of-concept, the urgency for remediation is high to ensure the reliability of forensic and analysis environments.

---METADATA---
VENDOR: ZKTeco
PRODUCT: CCTV Cameras
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
Certain ZKTeco CCTV cameras expose an undocumented, unauthenticated configuration export port that reveals sensitive information, including account credentials.

Executive Summary:
An unauthenticated configuration export vulnerability in ZKTeco CCTV cameras allows attackers to extract sensitive system credentials and service information.

Vulnerability Details

CVE-ID: CVE-2026-8598

Affected Software: ZKTeco CCTV cameras

Affected Versions: See vendor advisory

Vulnerability: This is an information disclosure vulnerability. An undocumented, unauthenticated port on the device provides access to a configuration export feature, which transmits sensitive data, including credentials, in plaintext.

Business Impact

The exposure of administrative credentials enables full, unauthorized access to the camera system. This could be leveraged for surveillance, credential stuffing against other internal systems, or persistent network infiltration. The 9.1 CVSS score reflects the high risk of this data exposure.

Remediation Plan

Immediate Action: Apply the latest security firmware update from ZKTeco.

Proactive Monitoring: Scan internal networks for ZKTeco devices and monitor for unauthorized connections to known configuration or management ports.

Compensating Controls: Block access to the identified configuration port via local firewall rules and ensure the cameras are placed on a restricted, non-public network.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations should immediately update their ZKTeco camera firmware to disable the insecure configuration port. If updates are not immediately available, restrict network access to the devices to prevent unauthorized access.

---METADATA---
VENDOR: Red Hat
PRODUCT: Red Hat build of Keycloak
AFFECTED_VERSIONS: 26.4, 26.4.12
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in the Red Hat build of Keycloak allows for the external control of assumed-immutable web parameters, potentially leading to unauthorized configuration changes or security bypasses.

Executive Summary:
An external control of immutable web parameters in Red Hat build of Keycloak (v26.4/26.4.12) allows authenticated users to manipulate system parameters, impacting overall security posture.

Vulnerability Details

CVE-ID: CVE-2026-7571

Affected Software: Red Hat build of Keycloak

Affected Versions: 26.4, 26.4.12

Vulnerability: The vulnerability involves the external control of assumed-immutable web parameters (CWE-472). An authenticated attacker can influence these parameters, which were intended to be immutable, potentially leading to an escalation of privileges or security configuration bypass.

Business Impact

As an identity and access management (IAM) solution, Keycloak is a high-value target. A CVSS score of 7.1 highlights the severity of this flaw, which could allow an authenticated user to alter authentication flows or security policies. The potential for unauthorized access to integrated downstream applications makes this a high-priority remediation item.

Remediation Plan

Immediate Action: Update the Red Hat build of Keycloak to version 26.4.12-1 or 26.4-17, depending on the specific deployment branch, as specified in the vendor advisory.

Proactive Monitoring: Audit Keycloak administrative logs for unauthorized changes to security realms or authentication policies that deviate from established baselines.

Compensating Controls: Limit access to the Keycloak administrative console to trusted IP ranges and enforce Multi-Factor Authentication (MFA) for all administrative accounts to minimize the risk of malicious authenticated activity.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for prior authentication mitigates the risk, but the impact within an IAM context remains significant.

Analyst Recommendation

Identity providers serve as the backbone of organizational security; therefore, any vulnerability affecting Keycloak must be treated as a priority. Administrators should apply the provided Red Hat security updates immediately to ensure the integrity of the authentication and authorization services.

---METADATA---
VENDOR: Red Hat
PRODUCT: Red Hat build of Keycloak
AFFECTED_VERSIONS: 26.2, 26.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Keycloak’s URL validation logic during redirect operations is flawed, allowing for potential Open Redirect vulnerabilities.

Executive Summary:
An Open Redirect vulnerability in the Red Hat build of Keycloak can be leveraged by attackers to facilitate phishing campaigns and credential theft.

Vulnerability Details

CVE-ID: CVE-2026-7504

Affected Software: Red Hat Red Hat build of Keycloak

Affected Versions: 26.2 (versions prior to 26.2.16-1/26.2-21) and 26.4 (versions prior to 26.4.12-1/26.4-17)

Vulnerability: The application incorrectly validates URLs during redirect operations (CWE-601), allowing an attacker to craft malicious links that redirect users to arbitrary, untrusted external sites.

Business Impact

Open redirect vulnerabilities are frequently used to enhance the credibility of phishing attacks, leading to potential credential harvesting and reputational damage. With a CVSS score of 8.1, the risk is elevated due to the ability to bypass security warnings by using a trusted domain as a redirector.

Remediation Plan

Immediate Action: Apply the vendor-provided security updates (RHSA-2026:19594 through RHSA-2026:19597) to reach the fixed versions.

Proactive Monitoring: Review application logs for redirect-related parameters and ensure all external redirects are validated against an allowlist.

Compensating Controls: Implement strict Content Security Policy (CSP) headers to restrict where the application can redirect users.

Exploitation Status

Public Exploit Available: No confirmed public exploit available.

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous as it relies on social engineering to trick users into visiting malicious sites via a legitimate domain.

Analyst Recommendation

Administrators must apply the latest security patches provided by Red Hat. Given the potential for this flaw to be weaponized in phishing campaigns, timely patching is essential to maintain user trust and security.

---METADATA---
VENDOR: DivvyDrive Information Technologies Inc.
PRODUCT: DivvyDrive
AFFECTED_VERSIONS: 4.8.2.9 through 4.8.3.1
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
DivvyDrive contains an open redirect vulnerability that facilitates parameter injection, potentially allowing attackers to redirect users to malicious external domains.

Executive Summary:
A critical open redirect and parameter injection vulnerability in DivvyDrive exposes users to phishing and malicious redirection, warranting immediate attention.

Vulnerability Details

CVE-ID: CVE-2026-6795

Affected Software: DivvyDrive Information Technologies Inc. DivvyDrive

Affected Versions: 4.8.2.9 before 4.8.3.2

Vulnerability: The software fails to properly validate user-supplied input in URL parameters, leading to an open redirect flaw. An unauthenticated attacker can leverage this to inject arbitrary parameters, potentially tricking users into interacting with malicious third-party content.

Business Impact

With a CVSS score of 9.6, this vulnerability poses a significant risk to organizational security. Successful exploitation can facilitate sophisticated phishing campaigns, leading to credential theft, unauthorized data access, and severe reputational damage.

Remediation Plan

Immediate Action: Upgrade to DivvyDrive version 4.8.3.2 or the latest available release provided by the vendor.

Proactive Monitoring: Review web server access logs for anomalous URL parameters and unexpected redirects to external domains.

Compensating Controls: Implement strict allow-lists for redirect destinations within your Web Application Firewall (WAF) to prevent unauthorized external redirection.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical CVSS severity, administrators should prioritize patching DivvyDrive to version 4.8.3.2 immediately. Failure to address this vulnerability increases the risk of successful social engineering attacks against your user base.

---METADATA---
VENDOR: Infor
PRODUCT: Multiple Products
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A privilege escalation vulnerability in Infor web applications allows standard users to gain super administrator access via parameter manipulation.

Executive Summary:
A critical privilege escalation vulnerability in Infor products allows authenticated users to gain unauthorized super administrator access, posing a severe risk of complete system compromise.

Vulnerability Details

CVE-ID: CVE-2026-6356

Affected Software: Infor Multiple Products

Affected Versions: See vendor advisory

Vulnerability: This is a privilege escalation vulnerability where an authenticated standard user can manipulate parameters to elevate their privileges to those of a super administrator.

Business Impact

The ability for a standard user to escalate to super administrator status grants an attacker full control over the affected application. This leads to unauthorized access to sensitive data, the potential for data exfiltration, and the ability to modify system configurations, resulting in significant operational and reputational damage. The CVSS score of 9.6 reflects the high impact on confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Update all affected Infor software installations to the latest vendor-provided version immediately.

Proactive Monitoring: Review application access logs for unusual administrative activity or changes to user permission structures initiated by non-administrative accounts.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to inspect and sanitize incoming HTTP parameters for unexpected structural modifications.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical severity of this privilege escalation flaw, organizations must prioritize patching. Failure to remediate this vulnerability could allow malicious actors to gain full administrative control over the business environment, leading to catastrophic data loss or system manipulation.

---METADATA---
VENDOR: DivvyDrive
PRODUCT: DivvyDrive
AFFECTED_VERSIONS: 4.8.2.9 through 4.8.3.1
---END_METADATA---

Description Summary:
A Cross-Site Request Forgery (CSRF) vulnerability in DivvyDrive versions 4.8.2.9 through 4.8.3.1 allows unauthorized actions to be performed on behalf of authenticated users.

Executive Summary:
A critical Cross-Site Request Forgery (CSRF) vulnerability in DivvyDrive allows attackers to trick users into executing unauthorized actions within the application.

Vulnerability Details

CVE-ID: CVE-2026-5791

Affected Software: DivvyDrive

Affected Versions: 4.8.2.9 through 4.8.3.1

Vulnerability: The application lacks sufficient CSRF protection, allowing an attacker to craft a malicious request that executes actions with the privileges of an authenticated user. This could lead to unauthorized data modification or administrative actions without the user's consent.

Business Impact

The CVSS score of 9.6 highlights the high risk associated with this flaw. CSRF can lead to the unauthorized changing of user passwords, deletion of data, or modification of system settings, severely impacting business operations and data integrity.

Remediation Plan

Immediate Action: Update the DivvyDrive installation to version 4.8.3.2 or later to ensure proper CSRF tokens and protections are in place.

Proactive Monitoring: Review audit logs for suspicious or unauthorized actions initiated by users that do not correspond to known internal workflows.

Compensating Controls: Ensure that users are properly logged out of the application when not in use and consider implementing browser-based protections or WAF rules to filter suspicious requests.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

CSRF vulnerabilities can be easily weaponized to perform actions that compromise the entire application environment. Administrators must move quickly to patch DivvyDrive to version 4.8.3.2 or later to prevent potential exploitation and maintain the integrity of user and system data.

---METADATA---
VENDOR: Mintplex Labs
PRODUCT: AnythingLLM
AFFECTED_VERSIONS: 1.9.1 and earlier
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A path traversal vulnerability in the AgentFlows component of AnythingLLM allows unauthenticated attackers to read or delete arbitrary files on the server.

Executive Summary:
A critical path traversal vulnerability in AnythingLLM allows unauthorized access to sensitive files, including API keys, and potential denial of service.

Vulnerability Details

CVE-ID: CVE-2026-5627

Affected Software: Mintplex Labs AnythingLLM

Affected Versions: 1.9.1 and earlier

Vulnerability: The vulnerability is located within the AgentFlows component due to improper input validation in loadFlow and deleteFlow methods. An unauthenticated attacker can manipulate file paths to escape the intended directory, allowing for arbitrary file disclosure or deletion.

Business Impact

With a CVSS score of 9.1, this vulnerability poses a severe risk to confidentiality and availability. Unauthorized access to configuration files can expose sensitive API keys, while the ability to delete system files leads to service disruption, causing significant operational downtime.

Remediation Plan

Immediate Action: Upgrade to AnythingLLM version 1.12.1 or later to resolve the path traversal flaw.

Proactive Monitoring: Audit server access logs for requests containing directory traversal sequences (e.g., ../) targeting the AgentFlows API endpoints.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter and block requests containing path traversal patterns before they reach the application.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this path traversal vulnerability necessitates an immediate update to the patched version. Administrators should also audit their server environments to ensure that sensitive configuration files were not compromised prior to the application of the patch.

---METADATA---
VENDOR: OVN (Open Virtual Network)
PRODUCT: Open Virtual Network
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security flaw has been identified in the Open Virtual Network (OVN) that could impact the integrity of virtualized network environments.

Executive Summary:
A critical security flaw within the Open Virtual Network (OVN) infrastructure poses a high risk to the stability and security of virtualized network environments.

Vulnerability Details

CVE-ID: CVE-2026-5367

Affected Software: OVN (Open Virtual Network)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a flaw in the OVN architecture, which may allow unauthorized actors to interfere with network policy enforcement or virtual machine traffic isolation.

Business Impact

A CVSS score of 8.6 highlights the potential for severe impact on virtualized data centers. Successful exploitation could lead to lateral movement between virtual networks, unauthorized access to sensitive data segments, and total loss of network isolation.

Remediation Plan

Immediate Action: Apply the latest security patches or updates provided by the OVN project or relevant distribution vendors.

Proactive Monitoring: Review OVN controller and database logs for suspicious configuration changes or unexpected network topology modifications.

Compensating Controls: Implement strict network segmentation and egress filtering to limit the potential blast radius should the virtual networking layer be compromised.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams managing virtualized infrastructure must treat this update as a high priority. Ensure that all OVN components are synchronized with the latest patched versions to maintain the integrity of the software-defined network.

---METADATA---
VENDOR: Keycloak
PRODUCT: Keycloak
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability has been identified in Keycloak, an open-source identity and access management solution, which could compromise authentication integrity.

Executive Summary:
Keycloak is affected by a critical flaw that could allow attackers to undermine identity management and gain unauthorized access to protected applications.

Vulnerability Details

CVE-ID: CVE-2026-4636

Affected Software: Keycloak

Affected Versions: See vendor advisory for affected versions

Vulnerability: The vulnerability exists within the Keycloak core identity management framework. While specific technical details are limited, flaws in such systems typically involve authentication bypasses, improper token validation, or privilege escalation vulnerabilities that can be exploited by an attacker.

Business Impact

Keycloak is a central component for authentication across many enterprises; therefore, a compromise here could grant an attacker access to any application integrated with the service. The CVSS score of 8.1 reflects the high risk of unauthorized data access and the potential for widespread lateral movement within an organization's infrastructure.

Remediation Plan

Immediate Action: Apply the latest security patches from the Keycloak project immediately to secure the identity provider.

Proactive Monitoring: Review Keycloak audit logs for unusual login patterns, unauthorized client registrations, or unexpected changes to realm roles and permissions.

Compensating Controls: Enable Multi-Factor Authentication (MFA) for all users and restrict access to the Keycloak admin console to internal, trusted networks only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation. However, identity providers are high-value targets for attackers, and the potential for exploitation is considered high.

Analyst Recommendation

Organizations relying on Keycloak for identity and access management must treat this vulnerability with the highest urgency. Applying the vendor's security updates is the only effective way to mitigate the risk to the entire authentication chain.

---METADATA---
VENDOR: Ritense
PRODUCT: Valtimo
AFFECTED_VERSIONS: >= 12.4.0, < 12.33.0; >= 13.0.0, < 13.26.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Valtimo business process automation platform incorrectly logs sensitive information, potentially exposing confidential data to unauthorized parties with access to log files.

Executive Summary:
Valtimo is affected by a sensitive information exposure vulnerability, where confidential data may be written to application logs, risking unauthorized access by administrative users.

Vulnerability Details

CVE-ID: CVE-2026-44516

Affected Software: Ritense Valtimo

Affected Versions: >= 12.4.0, < 12.33.0; >= 13.0.0, < 13.26.0

Vulnerability: This is a CWE-532 vulnerability involving the insertion of sensitive information into log files. The vulnerability requires high privileges (PR:H) to exploit, as an attacker must typically access the server or log management systems to retrieve the exposed data.

Business Impact

Successful exploitation results in the exposure of sensitive business or user data contained within log files. This could lead to a breach of confidentiality and regulatory non-compliance. The CVSS score of 7.6 highlights the critical nature of this disclosure, particularly in enterprise environments where business processes are automated.

Remediation Plan

Immediate Action: Update the Valtimo platform to version 12.33.0 or 13.26.0 depending on the current deployment branch.

Proactive Monitoring: Review existing log files for the presence of sensitive data and rotate logs that may contain exposed information.

Compensating Controls: Restrict access to log management systems (e.g., ELK, Splunk) to only essential administrative personnel to limit the exposure window.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The risk is primarily associated with internal actors or those who have already achieved administrative access to the infrastructure.

Analyst Recommendation

Administrators should prioritize patching the Valtimo platform to the specified versions to prevent sensitive data leakage. Furthermore, auditing existing logs for historical exposure is recommended to ensure that no sensitive data has already been compromised by unauthorized personnel.

---METADATA---
VENDOR: protobufjs
PRODUCT: protobuf.js
AFFECTED_VERSIONS: < 7.5.6, >= 8.0.0, < 8.0.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The protobuf.js library contains a code injection vulnerability when compiling protobuf definitions, potentially allowing attackers to execute arbitrary code.

Executive Summary:
A critical code injection vulnerability in protobuf.js allows attackers to execute arbitrary code, presenting a significant security risk to any application utilizing this library for serialization.

Vulnerability Details

CVE-ID: CVE-2026-44291

Affected Software: protobufjs protobuf.js

Affected Versions: < 7.5.6, >= 8.0.0, < 8.0.2

Vulnerability: This vulnerability is identified as CWE-94 (Code Injection). An unauthenticated attacker can exploit the way the library compiles protobuf definitions into JavaScript functions to achieve arbitrary code execution.

Business Impact

With a CVSS score of 8.1, this vulnerability poses a serious threat to application security. Successful exploitation could lead to full application compromise, allowing an attacker to manipulate data, bypass security controls, or extract sensitive information processed by the library.

Remediation Plan

Immediate Action: Update the npm package protobufjs to version 7.5.6 or 8.0.2, depending on the current branch in use.

Proactive Monitoring: Monitor applications using this library for unexpected behavior or unauthorized execution of JavaScript functions during the serialization/deserialization process.

Compensating Controls: If immediate patching is not feasible, restrict the library's ability to process untrusted or externally sourced protobuf definitions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The library's core function of compiling definitions makes it a high-value target for injection attacks.

Analyst Recommendation

Security teams must prioritize updating the protobufjs dependency to the identified secure versions. Failure to patch this vulnerability leaves applications vulnerable to remote code execution, which could be leveraged to compromise the entire host environment.

---METADATA---
VENDOR: Netatalk
PRODUCT: Netatalk
AFFECTED_VERSIONS: 3.1.0 through 4.4.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Multiple heap out-of-bounds reads exist in the Spotlight RPC unmarshalling code in Netatalk 3, potentially allowing information disclosure.

Executive Summary:
A heap out-of-bounds read vulnerability in Netatalk 3 allows authenticated attackers to potentially access sensitive memory.

Vulnerability Details

CVE-ID: CVE-2026-44066

Affected Software: Netatalk Netatalk

Affected Versions: 3.1.0 through 4.4.2

Vulnerability: The vulnerability is an out-of-bounds read (CWE-125) within the Spotlight RPC unmarshalling code. Based on the CVSS vector (PR:L), this requires a low-privilege authenticated user to successfully trigger the flaw.

Business Impact

Successful exploitation of this vulnerability could lead to the exposure of sensitive information residing in memory. While the CVSS score of 7.1 (High) reflects the potential for information disclosure and service impact, the requirement for authenticated access reduces the immediate risk to external-facing environments.

Remediation Plan

Immediate Action: Update Netatalk to version 4.4.3 or later, where this vulnerability has been addressed.

Proactive Monitoring: Review system and application logs for unusual RPC traffic or unexpected process crashes that may indicate exploitation attempts.

Compensating Controls: Restrict access to Netatalk services to trusted users only and ensure network segmentation is in place to limit the reach of potential attackers.

Exploitation Status

Public Exploit Available: No (unknown).

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's complexity requires specific interaction with the Spotlight RPC interface.

Analyst Recommendation

Given the severity of this memory-handling flaw, administrators should prioritize updating to the patched version, 4.4.3. Ensuring that all Netatalk instances are running the latest software version is the most effective way to mitigate this risk.

---METADATA---
VENDOR: Netatalk
PRODUCT: Netatalk
AFFECTED_VERSIONS: 1.3 through 4.4.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An out-of-bounds read vulnerability exists in the ASP session ID handling logic of Netatalk 1, potentially leading to service disruption or information disclosure.

Executive Summary:
An out-of-bounds read vulnerability in Netatalk 1 session handling poses a risk of service interruption and information disclosure to adjacent network attackers.

Vulnerability Details

CVE-ID: CVE-2026-44064

Affected Software: Netatalk Netatalk

Affected Versions: 1.3 through 4.4.2

Vulnerability: This is an out-of-bounds read (CWE-125) triggered during the handling of ASP session IDs. The CVSS vector (AV:A) indicates that the attacker must be positioned on the adjacent network to exploit this flaw.

Business Impact

The vulnerability carries a CVSS score of 7.1 (High), primarily due to its potential to cause a denial-of-service condition (impacting availability) or unauthorized information exposure. Organizations relying on Netatalk for file sharing services may face operational downtime if the service is crashed via this vector.

Remediation Plan

Immediate Action: Update the Netatalk installation to version 4.4.3 or later to resolve the session handling flaw.

Proactive Monitoring: Monitor network-level traffic for anomalous packets directed at the Netatalk service, specifically targeting session ID parameters.

Compensating Controls: Implement network access controls to ensure only authorized devices can communicate with the Netatalk service, mitigating the adjacent network attack vector.

Exploitation Status

Public Exploit Available: No (unknown).

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for adjacent network access limits the attack surface significantly.

Analyst Recommendation

The vulnerability necessitates a patch to the latest version (4.4.3) to ensure service stability and security. Administrators should schedule these updates during the next maintenance window to minimize potential exposure.

---METADATA---
VENDOR: getgrav
PRODUCT: Grav
AFFECTED_VERSIONS: < 2.0.0-beta.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Grav is susceptible to a Cross-site Scripting (XSS) vulnerability requiring user interaction, which could allow an authenticated attacker to gain high-impact control over the application.

Executive Summary:
A high-severity Cross-site Scripting vulnerability in Grav could allow authenticated attackers to gain unauthorized control over the application environment.

Vulnerability Details

CVE-ID: CVE-2026-42611

Affected Software: getgrav Grav

Affected Versions: < 2.0.0-beta.2

Vulnerability: This is a Cross-site Scripting (CWE-79) vulnerability that allows an authenticated attacker with low privileges to execute malicious scripts, facilitated by user interaction.

Business Impact

The CVSS score of 8.9 reflects the potential for significant technical impact, including unauthorized data access and potential system-wide compromise. Successful exploitation could lead to severe reputational damage and the loss of sensitive data, necessitating urgent remediation to protect the integrity of the Grav platform.

Remediation Plan

Immediate Action: Upgrade to Grav version 2.0.0-beta.2 or later to address this security flaw.

Proactive Monitoring: Monitor for anomalous user behavior and abnormal script execution patterns within the application logs.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block known XSS payloads and apply browser-based security headers to mitigate the risk of script execution.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 13, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly sensitive due to the potential for cross-site impact.

Analyst Recommendation

Given the high CVSS rating and the potential for severe impact, organizations should treat this as a critical update. Administrators must verify their current version and apply the patch to version 2.0.0-beta.2 immediately to prevent potential exploitation.

---METADATA---
VENDOR: Unfurl
PRODUCT: Unfurl
AFFECTED_VERSIONS: Through 2025.08
---END_METADATA---

Description Summary:
Unfurl contains an improper input validation vulnerability in configuration parsing that enables Flask debug mode by default, potentially leading to remote code execution.

Executive Summary:
An improper input validation vulnerability in Unfurl allows unauthenticated attackers to enable Flask debug mode, leading to potential remote code execution and sensitive information disclosure.

Vulnerability Details

CVE-ID: CVE-2026-40035

Affected Software: Unfurl Unfurl

Affected Versions: Through 2025.08

Vulnerability: This is an improper input validation flaw within the application's configuration parsing logic. Because the debug configuration value is improperly evaluated as a boolean, an unauthenticated attacker can trigger the Werkzeug debugger to execute arbitrary code.

Business Impact

The vulnerability carries a CVSS score of 9.1, indicating a critical risk to organizational security. Successful exploitation allows for complete system compromise, enabling attackers to extract sensitive data or gain persistent unauthorized access, which could lead to significant reputational damage and operational disruption.

Remediation Plan

Immediate Action: Upgrade Unfurl to the latest version immediately to patch the insecure configuration parsing logic.

Proactive Monitoring: Monitor application logs for unauthorized access to the Werkzeug debugger interface or unusual Flask initialization patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block requests attempting to reach the Werkzeug debug endpoint or suspicious debug-related headers.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical severity of this vulnerability, organizations should prioritize patching as the primary mitigation strategy. Failure to address this could result in full remote control of the affected infrastructure, necessitating immediate attention from IT security teams.

---METADATA---
VENDOR: Ubiquiti
PRODUCT: UniFi OS
AFFECTED_VERSIONS: UniFi OS Server: 0 to 5.0.7; UDM/UDM-Pro/UDM-SE/UDM-Pro-Max: 0 to 5.1.11; UDM-Beast: 0 to 5.1.10
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A path traversal vulnerability in UniFi OS devices allows a network-adjacent attacker with low privileges to access sensitive files on the underlying system.

Executive Summary:
A path traversal vulnerability in Ubiquiti UniFi OS devices allows low-privileged network users to read arbitrary system files, potentially leading to information disclosure.

Vulnerability Details

CVE-ID: CVE-2026-34911

Affected Software: Ubiquiti UniFi OS / UDM Series

Affected Versions: UniFi OS Server: < 5.0.8; UDM/UDM-Pro/UDM-SE/UDM-Pro-Max: < 5.1.12; UDM-Beast: < 5.1.11

Vulnerability: The vulnerability is a path traversal (CWE-22) flaw that allows an attacker with low privileges to manipulate file paths to access unauthorized system files. The attacker must have network access to the device.

Business Impact

With a CVSS score of 7.7, this vulnerability presents a significant risk to the confidentiality of the network infrastructure. Access to sensitive configuration files or system data could allow an attacker to extract credentials or other information needed to further compromise the network. This could lead to a total loss of confidentiality for the impacted management platform.

Remediation Plan

Immediate Action: Update all UniFi OS devices and servers to the specified patched versions (5.0.8 for Server, 5.1.12 for UDM/Pro/SE/Max, and 5.1.11 for UDM-Beast) immediately.

Proactive Monitoring: Monitor network traffic to UniFi management interfaces for suspicious HTTP requests containing directory traversal sequences (e.g., "../").

Compensating Controls: Restrict access to the UniFi management interface to trusted administrative subnets only, effectively removing the "low-privileged" network access required for exploitation.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable if the management interface is exposed to untrusted networks.

Analyst Recommendation

The severity of this flaw necessitates immediate attention. Organizations should verify their current firmware versions and apply the patches provided by Ubiquiti without delay to prevent unauthorized file access and potential credential theft.

---METADATA---
VENDOR: Infor
PRODUCT: Multiple Products
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security flaw has been identified in an unspecified component of Infor products.

Executive Summary:
A high-severity vulnerability in Infor products necessitates immediate attention to prevent potential system compromise.

Vulnerability Details

CVE-ID: CVE-2026-34003

Affected Software: Infor Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: A flaw was identified in an X component of the software, which, depending on the implementation, could be exploited to bypass security restrictions or access sensitive data.

Business Impact

With a CVSS score of 7.8, this vulnerability poses a significant risk to business operations relying on Infor software. Successful exploitation could lead to unauthorized access to enterprise data, potential system downtime, and a disruption of core business processes.

Remediation Plan

Immediate Action: Consult the official Infor security advisory to identify specific patches or configuration changes required for your product deployment and apply them immediately.

Proactive Monitoring: Review enterprise application logs for suspicious activity and unusual access patterns that could indicate unauthorized attempts to exploit the flaw.

Compensating Controls: Utilize network segmentation and access control lists to limit exposure of the Infor software to untrusted networks while patches are being applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations using Infor products must treat this vulnerability with high priority. It is essential to monitor vendor communications for specific remediation instructions and apply all relevant security updates to mitigate the risk of unauthorized system access.

---METADATA---
VENDOR: Spinnaker
PRODUCT: Spinnaker
AFFECTED_VERSIONS: Prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A SPeL injection vulnerability in the Spinnaker Echo service allows remote attackers to execute arbitrary Java code and access system files with full JVM privileges.

Executive Summary:
Spinnaker is subject to a critical remote code execution vulnerability that allows attackers to gain full system access via insecure SPeL expression processing.

Vulnerability Details

CVE-ID: CVE-2026-32613

Affected Software: Spinnaker

Affected Versions: Prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2

Vulnerability: The Echo service fails to restrict SPeL (Spring Expression Language) to a trusted context, allowing an authenticated or unauthenticated attacker (depending on deployment) to invoke arbitrary Java classes and execute commands on the underlying host.

Business Impact

The severity of this vulnerability is underscored by its CVSS score of 9.9, reflecting the potential for full system compromise. Successful exploitation grants attackers the ability to execute arbitrary commands, access sensitive credentials, and pivot within the infrastructure, leading to catastrophic data breaches and loss of control over the CI/CD pipeline.

Remediation Plan

Immediate Action: Upgrade Spinnaker to version 2026.1.0, 2026.0.1, 2025.4.2, or 2025.3.2. If patching cannot be performed immediately, disable the Echo service as a temporary workaround.

Proactive Monitoring: Review system logs for unusual process execution or unauthorized file access originating from the Echo service component.

Compensating Controls: Deploy a Web Application Firewall (WAF) or Runtime Application Self-Protection (RASP) tool to detect and block malicious expression language payloads directed at the Spinnaker services.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a total compromise vector. Security teams must treat this as a high-priority incident, ensuring that all Spinnaker instances are updated to the secure versions or that the vulnerable service is disabled to prevent exploitation.

---METADATA---
VENDOR: Moodle (Plugin by mdjnelson)
PRODUCT: Custom Certificate (mod_customcert)
AFFECTED_VERSIONS: Prior to versions 4.4.9 and 5.0.3
---END_METADATA---

Description Summary:
A critical flaw in the Moodle Custom Certificate plugin allows teachers to read or overwrite certificate elements from any other course in the system.

Executive Summary:
The Moodle Custom Certificate plugin contains a critical security flaw that allows authorized teachers to access and modify certificate data across different courses, leading to unauthorized data disclosure.

Vulnerability Details

CVE-ID: CVE-2026-30884

Affected Software: Custom Certificate Moodle Plugin (mod_customcert)

Affected Versions: Prior to versions 4.4.9 and 5.0.3

Vulnerability: The core_get_fragment and mod_customcert_save_element services fail to verify the context of a supplied elementid. This allows an authenticated teacher with management permissions in one course to manipulate certificates in any other course on the Moodle site.

Business Impact

This vulnerability enables cross-course data tampering and information disclosure, which can undermine the integrity of academic certifications. The CVSS score of 9.6 reflects the high impact on data integrity and confidentiality within the educational platform, potentially allowing for the unauthorized issuance of certificates.

Remediation Plan

Immediate Action: Update the Custom Certificate plugin to version 4.4.9 or 5.0.3 immediately through the Moodle plugin management interface.

Proactive Monitoring: Audit certificate modification logs for any changes made by users to courses they are not officially assigned to manage.

Compensating Controls: Review and restrict the mod/customcert:manage capability to only the most trusted administrative users until the patch is applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, the lack of context validation makes this vulnerability highly reliable for an authenticated attacker.

Analyst Recommendation

Moodle administrators must update the mod_customcert plugin to the fixed versions immediately. This action is necessary to prevent unauthorized users from compromising the validity of certificates across the entire installation.

---METADATA---
VENDOR: UXGROUP LLC
PRODUCT: Cast to TV Screen Mirroring
AFFECTED_VERSIONS: v2.2.77
---END_METADATA---

Description Summary:
UXGROUP LLC Cast to TV Screen Mirroring v2.2.77 is vulnerable to an arbitrary file overwrite during the import process, leading to code execution or data exposure.

Executive Summary:
An arbitrary file overwrite vulnerability in the Cast to TV Screen Mirroring application allows attackers to replace critical system files, potentially leading to full remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-30282

Affected Software: UXGROUP LLC Cast to TV Screen Mirroring

Affected Versions: v2.2.77

Vulnerability: This vulnerability occurs during the file import process of the application. An attacker can craft a malicious file that, when processed, overwrites critical internal application or system files, allowing for arbitrary code execution (ACE) or sensitive information exposure.

Business Impact

The ability to overwrite arbitrary files is a high-impact flaw that typically leads to complete system compromise. With a CVSS score of 9.0, a successful exploit could allow an attacker to gain a persistent foothold on the device, steal user data, or pivot to other systems on the network. This represents a significant risk to both individual user privacy and corporate network security.

Remediation Plan

Immediate Action: Users should immediately update the Cast to TV Screen Mirroring application to the latest available version provided by UXGROUP LLC.

Proactive Monitoring: Monitor device file systems for unauthorized changes to application directories and review system logs for unusual process executions following file imports.

Compensating Controls: Restrict application permissions to the minimum necessary for operation and avoid importing files from untrusted or unknown sources until the software is patched.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 31, 2026, there is no public information indicating active exploitation of this vulnerability. However, file overwrite vulnerabilities are a well-known vector for achieving code execution, making this a high-priority target for attackers.

Analyst Recommendation

The potential for arbitrary code execution necessitates an immediate response. We strongly recommend that all users of the Cast to TV Screen Mirroring application update to a secure version immediately. Organizations should also consider mobile device management (MDM) policies to ensure third-party applications are kept current.

---METADATA---
VENDOR: Gardyn (Infor)
PRODUCT: Gardyn
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A critical vulnerability in a Gardyn endpoint allows unauthenticated access to all registered user account information. This flaw permits total data exposure without valid credentials.

Executive Summary:
An unauthenticated data exposure vulnerability in Gardyn products allows unauthorized actors to access sensitive account information for all registered users, posing a severe privacy risk.

Vulnerability Details

CVE-ID: CVE-2026-28766

Affected Software: Gardyn (Infor)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a specific endpoint that fails to enforce authentication, exposing all user account data. An unauthenticated attacker can query this endpoint to retrieve sensitive information belonging to the entire user base.

Business Impact

The exposure of all registered user data represents a catastrophic failure of privacy controls, potentially leading to identity theft, massive reputational damage, and legal penalties. With a CVSS score of 9.3, this critical flaw indicates that the technical barrier to exploitation is low while the impact on data confidentiality is absolute. Failure to address this could result in a total loss of customer trust and significant business disruption.

Remediation Plan

Immediate Action: Update all affected Infor and Gardyn software to the latest available versions immediately to close the insecure endpoint.

Proactive Monitoring: Review web server and access logs for unusual traffic patterns directed at user profile or account management endpoints.

Compensating Controls: Implement a Web Application Firewall (WAF) to block unauthorized requests to sensitive API endpoints until the patch can be fully deployed.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Apr 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the sensitivity of the exposed data, the potential for exploitation is extremely high.

Analyst Recommendation

The severity of this unauthenticated data exposure cannot be overstated. Organizations must prioritize the application of the vendor-provided patch immediately. Given the 9.3 CVSS score, this should be treated as a top-priority remediation effort to prevent a massive data breach.

---METADATA---
VENDOR: Fujitsu Japan Limited
PRODUCT: Musetheque V4 Information Disclosure for IPKNOWLEDGE
AFFECTED_VERSIONS: V4L1 rev2203.0 and earlier
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A Cross-Site Request Forgery (CSRF) vulnerability in Fujitsu Musetheque V4 for IPKNOWLEDGE allows an unauthenticated attacker to perform unauthorized actions.

Executive Summary:
A CSRF vulnerability in Fujitsu Musetheque V4 for IPKNOWLEDGE poses a high risk of unauthorized state-changing actions due to the lack of proper request validation.

Vulnerability Details

CVE-ID: CVE-2026-28761

Affected Software: Fujitsu Japan Limited Musetheque V4 Information Disclosure for IPKNOWLEDGE

Affected Versions: V4L1 rev2203.0 and earlier

Vulnerability: This is a Cross-Site Request Forgery (CWE-352) vulnerability. The application fails to validate the origin of requests, allowing an unauthenticated attacker to trick a legitimate user into performing unintended actions.

Business Impact

With a CVSS score of 8.1, this vulnerability represents a high risk to organizational integrity. Successful exploitation could allow attackers to manipulate application data or perform administrative functions on behalf of an authenticated user, potentially leading to unauthorized data disclosure or service disruption.

Remediation Plan

Immediate Action: Consult the official JVN advisory (JVN#69128376) for available patches or configuration changes provided by Fujitsu.

Proactive Monitoring: Review application access logs for suspicious request patterns and unusual administrative activity originating from unexpected referrers.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect incoming traffic and block requests that lack proper CSRF tokens or originate from untrusted domains.

Exploitation Status

Public Exploit Available: No (Exploit_available: false)

Analyst Notes: As of May 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable via social engineering, targeting authenticated sessions to perform unauthorized actions.

Analyst Recommendation

Given the CVSS score of 8.1, this vulnerability should be prioritized for remediation. Organizations using affected versions of Musetheque V4 must verify their patch status through the vendor’s support channels and implement strict CSRF protections as recommended by the vendor.

---METADATA---
VENDOR: Red Hat
PRODUCT: Undertow (JBoss EAP / Apache Camel / Data Grid / Fuse / Process Automation / SSO)
AFFECTED_VERSIONS: Red Hat Undertow; Red Hat JBoss Enterprise Application Platform 7.0.0 and 8.0.0; Red Hat Build of Apache Camel - Hawtio 4.0; Red Hat Build of Apache Camel for Spring Boot 4.0; Red Hat Data Grid 8.0; Red Hat Fuse 7.0.0; Red Hat Process Automation 7.0; Red Hat Single Sign-On 7.0; Red Hat JBoss Enterprise Application Platform Expansion Pack; Red Hat Enterprise Linux 9.0
---END_METADATA---

Description Summary:
A request smuggling vulnerability in Red Hat Undertow allows attackers to bypass authentication and access restricted information by exploiting inconsistent HTTP header processing.

Executive Summary:
An authentication bypass flaw in Red Hat Undertow, caused by improper HTTP request header handling, allows attackers to manipulate requests and gain unauthorized access.

Vulnerability Details

CVE-ID: CVE-2026-28369

Affected Software: Red Hat Undertow and related enterprise products

Affected Versions: See individual product versions listed in the metadata above.

Vulnerability: This is an authentication bypass vulnerability stemming from request smuggling. The Undertow server incorrectly strips leading whitespace from HTTP header lines instead of rejecting malformed input, allowing attackers to manipulate request interpretation.

Business Impact

With a CVSS score of 8.7, this flaw poses a severe risk to enterprise environments. Successful exploitation allows unauthorized parties to bypass security controls, access sensitive information, or manipulate web caches, potentially leading to widespread data exposure and loss of confidentiality across the affected JBoss and Red Hat ecosystems.

Remediation Plan

Immediate Action: Apply the vendor-provided security patches for all affected Red Hat product versions immediately.

Proactive Monitoring: Inspect web server logs for irregular HTTP request structures or attempts to smuggle headers that deviate from standard protocol compliance.

Compensating Controls: Utilize a hardened reverse proxy or load balancer that enforces strict HTTP request validation to mitigate request smuggling attempts before they reach the backend server.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant architectural risk due to its potential to bypass core authentication mechanisms. Security teams must audit their environments to identify all instances of the affected Red Hat software and prioritize patching to eliminate the underlying request smuggling vector.

---METADATA---
VENDOR: Subnet Solutions
PRODUCT: PowerSYSTEM Center
AFFECTED_VERSIONS: 2020: 5.8.x-5.28.x; 2024: 6.0.x-6.1.x; 2026: 7.0.x
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An authorization bypass in the PowerSYSTEM Center REST API allows authenticated users with limited permissions to export sensitive device account information restricted to administrators.

Executive Summary:
An authenticated authorization bypass in Subnet Solutions PowerSYSTEM Center allows low-privileged users to access sensitive administrative data.

Vulnerability Details

CVE-ID: CVE-2026-26289

Affected Software: Subnet Solutions PowerSYSTEM Center

Affected Versions: See metadata for specific version ranges.

Vulnerability: This vulnerability involves incorrect authorization checks within the device account export REST API endpoint. It requires an authenticated user with limited permissions to successfully execute the attack.

Business Impact

Successful exploitation allows unauthorized access to sensitive device account information, which could be leveraged to escalate privileges or gain deeper insights into the industrial control system network. With a CVSS score of 8.2, the impact on confidentiality and integrity is substantial, particularly in critical infrastructure environments.

Remediation Plan

Immediate Action: Update PowerSYSTEM Center to the latest versions: PSC 2020 Update 29, PSC 2024 Update 2, or the PSC 2026 GA Hotfix.

Proactive Monitoring: Review user activity logs and audit trails to identify anomalous data export requests originating from low-privileged accounts.

Compensating Controls: Restrict access to the REST API to authorized management segments and ensure strong identity and access management (IAM) policies are enforced.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires prior authentication, which inherently limits the attack surface compared to unauthenticated vulnerabilities.

Analyst Recommendation

Organizations utilizing PowerSYSTEM Center must apply the provided updates to remediate the authorization flaw. Given the potential for sensitive information exposure, immediate patching and a review of user permission levels are strongly advised.

---METADATA---
VENDOR: iccDEV
PRODUCT: ICC Color Management Libraries
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the iccDEV color management libraries could allow an attacker to execute arbitrary code by processing a specially crafted ICC profile.

Executive Summary:
The iccDEV libraries are affected by a high-severity vulnerability that enables arbitrary code execution through the manipulation of ICC color management profiles.

Vulnerability Details

CVE-ID: CVE-2026-25584

Affected Software: iccDEV Libraries and Tools

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability involves a flaw in the iccDEV libraries' handling of ICC color management profiles. An unauthenticated attacker can exploit this by delivering a malicious profile to an application, triggering an internal error that allows for memory corruption and subsequent code execution.

Business Impact

The compromise of a core library used for image processing can lead to the widespread exposure of corporate assets. If exploited, this could result in the loss of sensitive data, unauthorized system access, and significant operational disruption. The CVSS score of 7.8 highlights the High severity and the urgent need for remediation to protect the software supply chain.

Remediation Plan

Immediate Action: Update all iccDEV libraries and tools to the latest version immediately to patch the profile parsing logic.

Proactive Monitoring: Monitor for unusual application behavior when processing images and review security logs for signs of memory corruption exploits.

Compensating Controls: Employ application whitelisting and use modern operating systems with advanced memory protections to mitigate the impact of potential exploits.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. The risk remains high as long as vulnerable versions of the library are in use across various software ecosystems.

Analyst Recommendation

The primary recommendation is to apply the vendor's patch without delay. Security administrators should conduct a thorough audit of their software inventory to identify and update any third-party applications that utilize the iccDEV libraries.

---METADATA---
VENDOR: zhanghuanhao
PRODUCT: LibrarySystem
AFFECTED_VERSIONS: Up to and including version 1
---END_METADATA---

Description Summary:
A high-severity vulnerability exists in the zhanghuanhao LibrarySystem through version 1, potentially allowing for unauthorized system access.

Executive Summary:
The zhanghuanhao LibrarySystem is affected by a high-severity vulnerability that could lead to unauthorized access or data compromise within the management system.

Vulnerability Details

CVE-ID: CVE-2026-2549

Affected Software: zhanghuanhao LibrarySystem (图书馆管理系统)

Affected Versions: Up to 1

Vulnerability: The vulnerability affects the LibrarySystem management software. Although the specific CWE is not detailed, the CVSS score of 7.3 suggests a critical flaw, potentially involving improper access control or input validation that an unauthenticated or low-privileged attacker could exploit.

Business Impact

A successful exploit could result in the unauthorized disclosure of library user data, modification of system records, or potential downtime for the library services. The severity score of 7.3 indicates that this flaw could significantly impact the operational integrity of the affected institution.

Remediation Plan

Immediate Action: Discontinue use of version 1 or apply any available security patches from the developer, zhanghuanhao, immediately.

Proactive Monitoring: Review web server and application logs for unusual POST requests or SQL injection patterns targeting the LibrarySystem's administrative interfaces.

Compensating Controls: Place the application behind a Web Application Firewall (WAF) with rules configured to block common exploit payloads and restrict access to the management interface to authorized IP addresses only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 17, 2026, there is no public information indicating active exploitation. The lack of detailed documentation for this product increases the risk of undiscovered flaws.

Analyst Recommendation

Given the high severity and the potential for unauthorized access, organizations using this software should prioritize remediation. If a patch is unavailable, consider migrating to a more modern and actively supported library management platform to ensure long-term security.

---METADATA---
VENDOR: OpenEMR
PRODUCT: OpenEMR
AFFECTED_VERSIONS: Prior to version 8.0.0
---END_METADATA---

Description Summary:
An SQL injection vulnerability in the OpenEMR Patient REST API allows authenticated users to execute arbitrary queries and access protected health information.

Executive Summary:
A critical SQL injection vulnerability in OpenEMR allows authenticated users to bypass security controls and access sensitive patient data, leading to a major breach of PHI.

Vulnerability Details

CVE-ID: CVE-2026-24908

Affected Software: OpenEMR OpenEMR

Affected Versions: Prior to version 8.0.0

Vulnerability: The vulnerability exists in the Patient REST API endpoint due to the lack of proper validation on the _sort parameter. An authenticated attacker with API access can inject malicious SQL commands into the ORDER BY clause, enabling unauthorized database interaction.

Business Impact

The impact of this flaw is severe, potentially resulting in the full exposure of Protected Health Information (PHI) and a violation of HIPAA regulations. Beyond data theft, attackers could compromise administrative credentials or manipulate medical records, leading to significant legal, financial, and reputational damage. The CVSS score of 9.9 underscores the critical nature of this injection flaw.

Remediation Plan

Immediate Action: Administrators must upgrade OpenEMR installations to version 8.0.0 or higher to eliminate the vulnerable code path in the REST API.

Proactive Monitoring: Review database logs for anomalous queries containing SQL keywords in the ORDER BY clauses and monitor API traffic for suspicious sorting requests.

Compensating Controls: Deploy a Web Application Firewall (WAF) with SQL injection detection rules to intercept and block malicious payloads targeting the REST API endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 25, 2026, there is no public information indicating active exploitation of this vulnerability. Given that OpenEMR is widely used in healthcare, the incentive for exploitation by threat actors is high.

Analyst Recommendation

Protecting patient data is a primary requirement for healthcare providers. Organizations using OpenEMR must prioritize this update immediately to prevent unauthorized access to sensitive medical databases and ensure regulatory compliance.

---METADATA---
VENDOR: Lantronix
PRODUCT: EDS3000PS
AFFECTED_VERSIONS: v3.1.0.0R2
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A vulnerability in the Lantronix EDS3000PS ltrx_evo component allows unauthenticated attackers to execute arbitrary code and retrieve sensitive information.

Executive Summary:
A critical remote code execution vulnerability in the Lantronix EDS3000PS allows unauthenticated attackers to execute arbitrary commands and exfiltrate sensitive data.

Vulnerability Details

CVE-ID: CVE-2025-70082

Affected Software: Lantronix EDS3000PS

Affected Versions: v3.1.0.0R2

Vulnerability: The flaw exists within the ltrx_evo component and permits unauthenticated remote attackers to execute arbitrary system code. This vulnerability allows for a complete compromise of the device's security posture.

Business Impact

The ability for an unauthenticated attacker to execute arbitrary code presents a catastrophic risk, including the potential for full system takeover, lateral movement within the network, and the theft of sensitive operational data. The 9.8 CVSS score reflects the high severity of a remote, unauthenticated RCE condition.

Remediation Plan

Immediate Action: Users should consult the vendor's security advisory (ICSA-26-069-02) to verify the availability of a firmware update and apply it immediately.

Proactive Monitoring: Continuously monitor device performance and system logs for unexpected processes or unauthorized connections originating from the device.

Compensating Controls: If a patch is not yet available, isolate the device from external networks using a segmented VLAN and ensure it is not accessible via the public internet.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of March 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability.

Analyst Recommendation

Due to the critical severity and the potential for remote code execution, this device must be treated as a high-risk asset. Administrators must prioritize applying vendor-issued patches as soon as they are made available to prevent exploitation of this RCE vulnerability.

---METADATA---
VENDOR: Bareiron
PRODUCT: p2r3
AFFECTED_VERSIONS: Commit 8e4d40
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The p2r3 Bareiron component is vulnerable to an out-of-bounds memory access error, potentially leading to information disclosure or service disruption.

Executive Summary:
An unauthenticated out-of-bounds memory access vulnerability in Bareiron p2r3 allows remote attackers to trigger a Denial of Service or access sensitive memory regions.

Vulnerability Details

CVE-ID: CVE-2025-69808

Affected Software: Bareiron p2r3

Affected Versions: Commit 8e4d40

Vulnerability: The vulnerability exists as an out-of-bounds memory access issue triggered by the processing of a specially crafted network packet. Because the flaw is reachable by unauthenticated attackers, it presents a significant remote attack vector.

Business Impact

Successful exploitation allows an attacker to crash the service, resulting in operational downtime, or potentially leak sensitive information stored in memory. With a CVSS score of 9.1, this vulnerability represents a major risk to service availability and data confidentiality, particularly for systems exposed to untrusted networks.

Remediation Plan

Immediate Action: Identify systems running the affected commit (8e4d40) and restrict network access to these components until a vendor-supplied patch is available.

Proactive Monitoring: Monitor network traffic for malformed packets or unusual traffic patterns targeting the p2r3 component.

Compensating Controls: Deploy a network-level firewall or Intrusion Prevention System (IPS) to filter suspicious traffic and block malformed packets before they reach the service.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Mar 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly severe due to its unauthenticated nature and the potential for memory corruption. Organizations should prioritize isolating affected systems and tracking the vendor's security disclosures for the release of an official patch.

---METADATA---
VENDOR: Xpoda Türkiye Information Technology Inc.
PRODUCT: Xpoda Studio
AFFECTED_VERSIONS: Through 09022026
---END_METADATA---

Description Summary:
Xpoda Studio is vulnerable to SQL injection due to improper neutralization of special elements, potentially allowing unauthorized database access and manipulation.

Executive Summary:
A critical SQL injection vulnerability in Xpoda Studio allows attackers to execute unauthorized database commands, threatening the confidentiality and integrity of all stored data.

Vulnerability Details

CVE-ID: CVE-2025-6830

Affected Software: Xpoda Studio

Affected Versions: Through 09022026

Vulnerability: The application fails to properly sanitize user-supplied input before using it in SQL queries. This allows an attacker to "inject" malicious SQL code, which the database then executes, potentially bypassing authentication or extracting data.

Business Impact

A CVSS score of 9.8 reflects the high probability of a full data breach. Attackers can read sensitive tables, modify application logic by changing database values, or even gain administrative access to the server if the database is misconfigured. The vendor's lack of response to the disclosure increases the risk for users.

Remediation Plan

Immediate Action: Since the vendor has not responded, administrators should attempt to update to the latest version and contact the vendor for a specific fix.

Proactive Monitoring: Enable deep packet inspection on your WAF to detect and block SQL injection patterns (e.g., UNION SELECT, OR 1=1).

Compensating Controls: Ensure the database user for Xpoda Studio has the most restrictive permissions possible (least privilege) and use a database firewall to monitor for anomalous queries.

Exploitation Status

Public Exploit Available: false

Analyst Notes: The vendor was contacted but did not respond. This "silent" status often means a patch may not be readily available, significantly increasing the risk to current users.

Analyst Recommendation

Given the lack of vendor engagement and the 9.8 CVSS score, organizations should consider the software high-risk. If a patch is not available, consider isolating the application from the internet or moving to a secured alternative until a fix is confirmed.

---METADATA---
VENDOR: n8n
PRODUCT: n8n Workflow Automation Platform
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the n8n open-source workflow automation platform could allow for unauthorized access or execution. The flaw affects the core automation engine and its handling of workflow data.

Executive Summary:
The n8n workflow automation platform contains a high-severity vulnerability that could permit an attacker to interfere with automated business processes and sensitive data integrations.

Vulnerability Details

CVE-ID: CVE-2025-61917

Affected Software: n8n n8n

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The n8n platform, used for connecting various SaaS applications, suffers from a vulnerability in its workflow processing logic. While the specific authentication requirement is not explicitly stated, vulnerabilities in such platforms often involve the risk of unauthenticated attackers triggering workflows or accessing execution logs.

Business Impact

The impact of this vulnerability is significant due to n8n's role in handling sensitive API keys and cross-platform data. A CVSS score of 7.7 reflects a High severity risk where an exploit could lead to data exfiltration, unauthorized execution of business logic, and the compromise of connected third-party services, resulting in substantial operational and reputational damage.

Remediation Plan

Immediate Action: Update the n8n instance to the latest stable version immediately to address the underlying vulnerability in the workflow engine.

Proactive Monitoring: Audit execution logs for any unauthorized workflow triggers or anomalous data transfers to unknown external endpoints.

Compensating Controls: Deploy the n8n instance behind a VPN or use a Web Application Firewall (WAF) to restrict access to the management interface to trusted IP addresses only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. Given the increasing popularity of low-code automation tools, this platform is a high-value target for attackers seeking to pivot into cloud environments.

Analyst Recommendation

Given the High severity and the critical nature of automation platforms in modern business operations, organizations must prioritize this patch. Failure to secure n8n instances could expose the entire interconnected software ecosystem of the enterprise to unauthorized access.

---METADATA---
VENDOR: Chamilo
PRODUCT: Chamilo LMS
AFFECTED_VERSIONS: Prior to version 1.11.34
---END_METADATA---

Description Summary:
Chamilo LMS prior to 1.11.34 contains a stored XSS vulnerability in the learning path Settings field, allowing low-privileged trainers to hijack administrator accounts.

Executive Summary:
A critical stored cross-site scripting (XSS) vulnerability in Chamilo LMS allows authenticated attackers to escalate privileges and take over administrator accounts via malicious JavaScript injection.

Vulnerability Details

CVE-ID: CVE-2025-59542

Affected Software: Chamilo LMS

Affected Versions: Prior to version 1.11.34

Vulnerability: An authenticated attacker with "trainer" or similar low-level privileges can inject malicious JavaScript into the "course learning path Settings" field. When an administrator or another user views the course information page, the script executes, enabling the exfiltration of sensitive session tokens.

Business Impact

With a CVSS score of 9.0, this vulnerability presents a high risk of account takeover (ATO). A successful attack against an administrator results in full control over the Learning Management System, including access to student records, proprietary course materials, and the ability to modify site-wide configurations.

Remediation Plan

Immediate Action: Update Chamilo LMS to version 1.11.34 or later to address the insufficient input sanitization in the learning path settings.

Proactive Monitoring: Inspect the database for scripts or unusual HTML tags within the course learning path tables and monitor for anomalous administrative logins from unrecognized IP addresses.

Compensating Controls: Implement a robust Content Security Policy (CSP) to prevent the execution of inline scripts and restrict the domains from which external scripts can be loaded.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation. However, stored XSS in administrative interfaces is a common vector for internal privilege escalation.

Analyst Recommendation

Organizations using Chamilo LMS should apply the 1.11.34 patch immediately. Furthermore, security teams should educate course creators on secure content practices and consider implementing multi-factor authentication (MFA) to mitigate the impact of stolen session cookies.

---METADATA---
VENDOR: Emit Informatics and Communication Technologies Industry and Trade Ltd. Co.
PRODUCT: DIGITA Efficiency Management System
AFFECTED_VERSIONS: Through 03022026
---END_METADATA---

Description Summary:
The DIGITA Efficiency Management System is vulnerable to a critical SQL Injection flaw. An unauthenticated attacker can execute arbitrary SQL commands to manipulate or extract sensitive data.

Executive Summary:
A critical SQL Injection vulnerability in the DIGITA Efficiency Management System allows unauthenticated attackers to gain unauthorized access to the underlying database and compromise system integrity.

Vulnerability Details

CVE-ID: CVE-2025-5319

Affected Software: Emit Informatics DIGITA Efficiency Management System

Affected Versions: All versions through February 3, 2026

Vulnerability: The application fails to properly neutralize special elements used in SQL commands. This allows an unauthenticated remote attacker to inject malicious SQL queries into vulnerable parameters, potentially leading to unauthorized data retrieval or administrative access.

Business Impact

A successful exploit could lead to the total compromise of the application's database, resulting in the theft of proprietary business data, user credentials, and operational records. Given the CVSS score of 9.8, the impact is categorized as Critical, posing a high risk of permanent data loss, regulatory non-compliance, and significant reputational damage.

Remediation Plan

Immediate Action: Users should contact the vendor for a definitive patch; however, as the vendor has been unresponsive, organizations should consider migrating to a supported platform or implementing strict input filtering.

Proactive Monitoring: Monitor database logs for unusual query patterns, such as "UNION SELECT" statements or attempts to access system tables (e.g., information_schema).

Compensating Controls: Deploy a Web Application Firewall (WAF) with SQL injection protection rules to intercept and block malicious payloads targeting the DIGITA web interface.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, the vendor's lack of response suggests that no official patch may be forthcoming, increasing the window of risk for current users.

Analyst Recommendation

The severity of this SQL Injection vulnerability cannot be overstated, especially given the lack of vendor communication. Organizations must prioritize the implementation of compensating controls, such as a WAF, and evaluate the long-term viability of the product. Immediate isolation of the database from direct external access is mandatory.

---METADATA---
VENDOR: Tegsoft
PRODUCT: Online Support Application
AFFECTED_VERSIONS: V3 through 31122025
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A reflected cross-site scripting (XSS) vulnerability in the Tegsoft Online Support Application allows attackers to execute arbitrary scripts in a user's browser.

Executive Summary:
The Tegsoft Online Support Application is vulnerable to reflected XSS, which could allow attackers to execute malicious scripts against users of the platform.

Vulnerability Details

CVE-ID: CVE-2025-14320

Affected Software: Tegsoft Online Support Application

Affected Versions: V3 through 31122025

Vulnerability: The application fails to properly neutralize user-supplied input during web page generation, leading to a reflected XSS vulnerability. This allows an attacker to inject malicious JavaScript into a URL or request, which is then executed in the context of the victim's session.

Business Impact

A CVSS score of 9.8 indicates a critical risk, as XSS can be used to hijack user sessions, steal sensitive session cookies, or redirect users to malicious sites. This compromise can lead to full account takeover and unauthorized access to support data, resulting in significant reputational and operational harm.

Remediation Plan

Immediate Action: Consult the vendor for the latest security release or patch addressing input neutralization in the Online Support Application.

Proactive Monitoring: Monitor web server logs for suspicious URL parameters containing script tags or encoded characters typical of XSS payloads.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured with rules to detect and block common cross-site scripting attack patterns.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of May 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Reflected XSS is a common but dangerous vector. Users of the Tegsoft Online Support Application should restrict access to the affected web interfaces until a patch is applied and verify that all user inputs are properly sanitized by the application framework.

---METADATA---
VENDOR: NTN Information Processing Services
PRODUCT: Smart Panel
AFFECTED_VERSIONS: before 20251215
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
An unrestricted file upload vulnerability in NTN Smart Panel allows unauthenticated attackers to bypass access controls and execute arbitrary functionality.

Executive Summary:
A critical file upload vulnerability in NTN Smart Panel permits unauthenticated access to restricted functions, posing a severe risk of system compromise.

Vulnerability Details

CVE-ID: CVE-2025-14014

Affected Software: NTN Information Processing Services Smart Panel

Affected Versions: before 20251215

Vulnerability: This vulnerability involves the unrestricted upload of dangerous file types, which allows an unauthenticated attacker to bypass established Access Control Lists (ACLs) and interact with restricted system functions.

Business Impact

The ability for an unauthenticated user to upload arbitrary files and bypass ACLs constitutes a critical security failure. With a CVSS score of 9.8, this vulnerability could lead to full system takeover, unauthorized data exfiltration, or the deployment of persistent malicious software, resulting in significant operational downtime and reputational damage.

Remediation Plan

Immediate Action: Upgrade Smart Panel to version 20251215 or later immediately to restrict unauthorized file uploads and enforce proper ACL validation.

Proactive Monitoring: Inspect web server logs for suspicious file upload patterns, particularly those originating from unknown or unauthorized IP addresses, and monitor for unauthorized access to administrative endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict file extension and content-type filtering to block malicious uploads until the patch can be applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Feb 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this flaw and the lack of authentication required for exploitation, organizations must prioritize patching. Failure to remediate this vulnerability leaves the environment exposed to remote code execution and full administrative compromise.

---METADATA---
VENDOR: WSO2
PRODUCT: Identity Server
AFFECTED_VERSIONS: WSO2 Identity Server 5.11.0.130 up to (excluding) 5.11.0.299
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in the Velocity template engine allows authenticated administrators to perform remote code execution via injected template syntax.

Executive Summary:
WSO2 Identity Server is affected by a critical template injection vulnerability that enables remote code execution for authenticated administrators.

Vulnerability Details

CVE-ID: CVE-2025-12107

Affected Software: WSO2 Identity Server

Affected Versions: 5.11.0.130 up to (excluding) 5.11.0.299

Vulnerability: This vulnerability (CWE-1336) involves improper neutralization of special elements within a third-party Velocity template engine, allowing an authenticated administrator to execute arbitrary template code on the underlying server.

Business Impact

Successful exploitation allows an attacker with administrative access to achieve remote code execution, leading to full system compromise. Given the CVSS score of 10.0, this represents an extreme risk to confidentiality, integrity, and availability, potentially allowing an attacker to move laterally within the network or exfiltrate identity-related sensitive data.

Remediation Plan

Immediate Action: Update WSO2 Identity Server to version 5.11.0.299 or later as per the vendor's security advisory.

Proactive Monitoring: Monitor server logs for unauthorized modifications to template files and anomalous execution patterns originating from administrative sessions.

Compensating Controls: Ensure strict access control lists (ACLs) for administrative panels and utilize a Web Application Firewall (WAF) to detect and block suspicious template syntax patterns.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Feb 20, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability.

Analyst Recommendation

The severity of this flaw cannot be overstated, as it provides a direct path to total system takeover for anyone possessing administrative credentials. Administrators must prioritize applying the vendor-provided patch immediately to eliminate the underlying template engine vulnerability.

---METADATA---
VENDOR: Infor
PRODUCT: Multiple Products
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A permissions issue in multiple Infor products has been addressed with additional restrictions to prevent unauthorized access.

Executive Summary:
Multiple Infor products are affected by a high-severity permissions vulnerability that could allow unauthorized users to access restricted resources or functions.

Vulnerability Details

CVE-ID: CVE-2024-44219

Affected Software: Infor Multiple Products

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability involves a permissions issue where access controls were insufficiently enforced. An authenticated user could potentially exploit this flaw to bypass intended restrictions and gain access to sensitive data or administrative capabilities.

Business Impact

The inability to properly enforce permissions can lead to unauthorized data disclosure and privilege escalation. With a CVSS score of 7.5, this high-severity vulnerability could result in the compromise of sensitive business information and the loss of data integrity, potentially leading to regulatory non-compliance and financial loss.

Remediation Plan

Immediate Action: Apply the vendor-provided security updates immediately to implement the necessary permission restrictions.

Proactive Monitoring: Review user access logs and permission change history for any signs of unauthorized activity or privilege escalation attempts.

Compensating Controls: Enforce the principle of least privilege (PoLP) across all Infor applications to minimize the impact of any single account compromise.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation of this vulnerability. This is a late disclosure of a 2024 vulnerability, emphasizing the need to ensure all legacy systems are patched.

Analyst Recommendation

Organizations using Infor products must prioritize the application of these security updates. Strengthening access controls is a fundamental security requirement, and this patch is critical to preventing unauthorized lateral movement within the application.

---METADATA---
VENDOR: Edimax
PRODUCT: EW-7438RPn
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A security vulnerability exists in the Edimax EW-7438RPn range extender that could allow for unauthorized access or system compromise.

Executive Summary:
The Edimax EW-7438RPn range extender contains a high-severity vulnerability that could allow an attacker to compromise the device and intercept network traffic.

Vulnerability Details

CVE-ID: CVE-2020-37097

Affected Software: Edimax EW-7438RPn

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability affects the Edimax EW-7438RPn hardware. While technical specifics are limited in the late disclosure, the high CVSS score suggests a critical failure in the device's management interface or network stack, likely exploitable by an unauthenticated attacker on the local network.

Business Impact

A successful exploit of this range extender could lead to a complete compromise of the local network infrastructure. Attackers could perform man-in-the-middle (MitM) attacks, redirecting or capturing sensitive data transmitted by connected users. With a CVSS score of 7.5, the risk to confidentiality and integrity is significant, potentially leading to the exposure of corporate credentials or internal communications.

Remediation Plan

Immediate Action: Administrators should immediately check for and apply the latest firmware updates from the Edimax support portal to mitigate this flaw.

Proactive Monitoring: Monitor network traffic originating from IoT and networking hardware for unusual outbound connections or unauthorized configuration changes.

Compensating Controls: Isolate range extenders and similar networking hardware on a dedicated management VLAN with strict access control lists (ACLs) to prevent lateral movement.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and its late disclosure, the potential for exploitation remains a high priority for organizations using legacy networking hardware.

Analyst Recommendation

The high severity of this vulnerability necessitates immediate remediation. Organizations should prioritize updating the firmware on all Edimax EW-7438RPn devices or consider replacing end-of-life hardware that no longer receives security patches to maintain a robust security posture.

---METADATA---
VENDOR: EspoCRM
PRODUCT: EspoCRM
AFFECTED_VERSIONS: 5.8.5
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
EspoCRM 5.8.5 is vulnerable to an authentication bypass via manipulation of authorization headers, allowing unauthorized access to administrative user information and privileges.

Executive Summary:
A critical authentication vulnerability in EspoCRM 5.8.5 allows unauthenticated attackers to hijack user accounts and escalate privileges to administrative levels.

Vulnerability Details

CVE-ID: CVE-2020-37094

Affected Software: EspoCRM

Affected Versions: 5.8.5

Vulnerability: This vulnerability involves the improper handling of Basic Authorization and Espo-Authorization tokens. Attackers can decode and modify these headers to bypass authentication mechanisms and impersonate other users, including administrators.

Business Impact

The ability for an attacker to gain unauthorized administrative access poses a severe threat to data integrity, confidentiality, and system availability. Given the CVSS score of 9.8, this vulnerability could lead to total system compromise, theft of sensitive customer data, and unauthorized modification of business records.

Remediation Plan

Immediate Action: Upgrade to the latest available version of EspoCRM provided by the vendor to remediate the header manipulation flaw.

Proactive Monitoring: Review application access logs for anomalous authorization header patterns or unauthorized access attempts to administrative endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and validate authorization headers for malformed or suspicious token strings.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Feb 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a critical security risk that requires immediate attention. Organizations utilizing EspoCRM 5.8.5 should prioritize patching to the latest version to prevent unauthorized administrative access and potential data exfiltration.

---METADATA---
VENDOR: Netis
PRODUCT: E1+ Range Extender
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A vulnerability in the Netis E1+ 1 range extender could allow for unauthorized device manipulation. This flaw is distinct from other reported issues for the same product line and affects core firmware components.

Executive Summary:
A high-severity vulnerability in the Netis E1+ 1 device could permit an attacker to take control of the networking hardware, leading to a compromise of the local network environment.

Vulnerability Details

CVE-ID: CVE-2020-37093

Affected Software: Netis E1+

Affected Versions: See vendor advisory

Vulnerability: This vulnerability affects the Netis E1+ 1. Similar to other flaws in this product line, it likely stems from improper input validation or insecure default configurations in the firmware, which could be exploited by an unauthenticated attacker with network access to the device.

Business Impact

The impact of a compromised network extender includes the potential for man-in-the-middle (MitM) attacks, data theft, and the loss of network availability. A CVSS score of 7.5 highlights the High severity of this risk, as it directly undermines the security perimeter of the organization's physical network infrastructure.

Remediation Plan

Immediate Action: Immediately update the Netis E1+ firmware to the most recent version provided by the manufacturer.

Proactive Monitoring: Perform regular audits of network device logs and monitor for unexpected firmware modifications or configuration changes.

Compensating Controls: Isolate IoT and network infrastructure devices on a separate VLAN to limit the potential impact of a device compromise on the primary corporate network.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation. This late-disclosed vulnerability (originally from 2020) emphasizes the ongoing risk posed by legacy networking hardware that may not be regularly audited for security.

Analyst Recommendation

It is critical to apply the necessary firmware updates immediately. Given the High CVSS score, any delay in remediation could leave the network vulnerable to attackers seeking to exploit unpatched infrastructure for data exfiltration or as a platform for further attacks.

---METADATA---
VENDOR: Infor
PRODUCT: Kados R10 GreenBee
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Kados R10 GreenBee is susceptible to SQL injection via the filter_user_mail parameter, allowing unauthorized database query manipulation.

Executive Summary:
The Kados R10 GreenBee application contains an SQL injection vulnerability that could lead to unauthorized database access and data compromise.

Vulnerability Details

CVE-ID: CVE-2019-25704

Affected Software: Infor Kados R10 GreenBee

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The filter_user_mail parameter is not properly sanitized, allowing attackers to inject malicious SQL commands into the application's database queries.

Business Impact

Successful exploitation could result in unauthorized access to sensitive data, leading to a significant breach. The CVSS score of 8.2 signifies a high-severity threat that requires immediate intervention from security teams.

Remediation Plan

Immediate Action: Apply the vendor-provided security patch to the affected system.

Proactive Monitoring: Review database and application logs for unusual query activity that might indicate an injection attempt.

Compensating Controls: Deploy WAF rules to detect and block SQL injection patterns in the filter_user_mail parameter.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams must prioritize patching this vulnerability to ensure the integrity of the system's data. Immediate action is required to reduce the risk of unauthorized database interaction.

---METADATA---
VENDOR: Infor
PRODUCT: Kados R10 GreenBee
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Kados R10 GreenBee is vulnerable to SQL injection via the id_project parameter, allowing attackers to manipulate database queries.

Executive Summary:
An SQL injection vulnerability in Infor Kados R10 GreenBee enables unauthorized database manipulation, posing a significant security risk.

Vulnerability Details

CVE-ID: CVE-2019-25702

Affected Software: Infor Kados R10 GreenBee

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability exists because the id_project parameter is not properly sanitized, allowing attackers to inject SQL commands into the backend database.

Business Impact

Unauthorized database interaction could lead to data theft or system compromise, causing significant harm to business operations. The CVSS score of 8.2 highlights the severity of this issue and the importance of timely remediation.

Remediation Plan

Immediate Action: Update the Kados R10 GreenBee software to the latest version provided by the vendor.

Proactive Monitoring: Monitor database query logs for suspicious activity and unauthorized access attempts.

Compensating Controls: Use a Web Application Firewall (WAF) to filter out malicious SQL injection attempts targeting the id_project parameter.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations should ensure that all security updates are applied immediately. Implementing strong database access controls and monitoring will help mitigate the potential for exploitation.

---METADATA---
VENDOR: Infor
PRODUCT: Kados R10 GreenBee
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Kados R10 GreenBee is susceptible to SQL injection via the sort_direction parameter, allowing for unauthorized database query manipulation.

Executive Summary:
An SQL injection vulnerability in Infor Kados R10 GreenBee allows attackers to execute malicious database queries, threatening data integrity.

Vulnerability Details

CVE-ID: CVE-2019-25700

Affected Software: Infor Kados R10 GreenBee

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The application fails to sanitize the sort_direction parameter, permitting attackers to inject arbitrary SQL statements. This vulnerability allows for unauthorized database interaction.

Business Impact

Exploiting this vulnerability could lead to unauthorized data access or modification, potentially causing significant business disruption. The CVSS score of 8.2 emphasizes the need for rapid remediation to protect organizational assets.

Remediation Plan

Immediate Action: Apply the vendor-supplied security patch to the affected system.

Proactive Monitoring: Monitor for anomalous query patterns in database logs and review system access logs for suspicious activity.

Compensating Controls: Deploy WAF rules to block malicious SQL injection payloads targeting the sort_direction parameter.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should prioritize patching this vulnerability to prevent potential unauthorized database access. Consistent with high-severity vulnerabilities, immediate action is recommended.

---METADATA---
VENDOR: Infor
PRODUCT: Kados R10 GreenBee
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Kados R10 GreenBee contains an SQL injection vulnerability in the id_to_delete parameter, enabling unauthorized database query manipulation.

Executive Summary:
The Kados R10 GreenBee application is vulnerable to SQL injection, which could allow an attacker to maliciously modify or delete database records.

Vulnerability Details

CVE-ID: CVE-2019-25698

Affected Software: Infor Kados R10 GreenBee

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The id_to_delete parameter is not properly sanitized, allowing attackers to inject SQL commands into the application's database queries. This vulnerability allows for unauthorized data manipulation.

Business Impact

Successful exploitation could result in the loss of data or unauthorized access to system records, leading to significant disruption. The CVSS score of 8.2 indicates a high-severity threat that requires immediate attention from security teams.

Remediation Plan

Immediate Action: Update the Kados R10 GreenBee software to the latest version as directed by the vendor.

Proactive Monitoring: Review database logs for suspicious delete or modification commands that do not align with standard user behavior.

Compensating Controls: Use a Web Application Firewall (WAF) to detect and block malicious SQL injection strings in the id_to_delete parameter.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Prompt remediation is necessary to ensure the integrity of the application's database. IT administrators should verify that all patches are applied to eliminate the risk of exploitation.

---METADATA---
VENDOR: Infor
PRODUCT: Kados R10 GreenBee
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Kados R10 GreenBee contains an SQL injection vulnerability in the language_tag parameter, allowing attackers to manipulate database queries.

Executive Summary:
An SQL injection vulnerability in Infor Kados R10 GreenBee allows unauthorized database manipulation through the language_tag parameter.

Vulnerability Details

CVE-ID: CVE-2019-25696

Affected Software: Infor Kados R10 GreenBee

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The application improperly handles the language_tag parameter, which is used in database queries. This flaw allows an attacker to inject malicious SQL commands, potentially resulting in unauthorized data access.

Business Impact

Exploitation of this flaw could lead to data exfiltration or unauthorized database modification, impacting business operations and data security. The CVSS score of 8.2 reflects the high severity and the potential for significant impact on the organization.

Remediation Plan

Immediate Action: Apply the vendor-recommended security updates to fix the input validation vulnerability.

Proactive Monitoring: Monitor for suspicious activity in application logs and ensure database query logging is enabled.

Compensating Controls: Deploy WAF rules to inspect traffic for SQL injection attempts specifically targeting the language_tag parameter.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations should prioritize applying the vendor-provided patch to mitigate this risk. Regular auditing of database access is recommended to ensure no unauthorized activity occurs.

---METADATA---
VENDOR: Infor
PRODUCT: Kados R10 GreenBee
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Kados R10 GreenBee is vulnerable to unauthenticated SQL injection via the user2reset parameter, facilitating unauthorized database interaction.

Executive Summary:
An unauthenticated SQL injection vulnerability in Infor Kados R10 GreenBee poses a critical risk to data confidentiality and database stability.

Vulnerability Details

CVE-ID: CVE-2019-25694

Affected Software: Infor Kados R10 GreenBee

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The application fails to perform sufficient input validation on the user2reset parameter, permitting unauthenticated attackers to execute arbitrary SQL commands. This allows for direct interaction with the backend database.

Business Impact

The ability for an unauthenticated attacker to manipulate database queries poses a severe risk, including the potential for complete database compromise. With a CVSS score of 8.2, this vulnerability is a high-priority threat that could lead to widespread data loss or unauthorized access.

Remediation Plan

Immediate Action: Immediately apply the latest security updates or patches provided by the vendor.

Proactive Monitoring: Review security logs for suspicious database queries and monitor for unusual traffic spikes associated with the user2reset function.

Compensating Controls: Utilize a Web Application Firewall (WAF) to sanitize inputs and block requests containing SQL injection patterns directed at the user2reset parameter.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the unauthenticated nature of this vulnerability, it constitutes a significant risk. Remediation should be treated as a high priority to prevent potential exploitation by malicious actors.

---METADATA---
VENDOR: Infor
PRODUCT: Kados R10 GreenBee
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Kados R10 GreenBee is susceptible to SQL injection via the 'id_to_modify' parameter, allowing unauthorized database query manipulation.

Executive Summary:
The Kados R10 GreenBee platform suffers from an SQL injection vulnerability that could allow unauthorized modification or exfiltration of database records.

Vulnerability Details

CVE-ID: CVE-2019-25692

Affected Software: Infor Kados R10 GreenBee

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability occurs because the 'id_to_modify' parameter is not adequately sanitized before being used in database queries. This flaw allows an attacker to inject SQL commands, potentially altering database content.

Business Impact

Exploitation of this vulnerability could lead to the unauthorized modification of critical business data, resulting in significant operational disruption and loss of data integrity. With a CVSS score of 8.2, this issue presents a high-level risk that should be addressed immediately.

Remediation Plan

Immediate Action: Apply the vendor-supplied security patch to the Kados R10 GreenBee application.

Proactive Monitoring: Monitor database query logs for unexpected modification commands or unauthorized access to sensitive tables.

Compensating Controls: Implement WAF rules to inspect incoming traffic and block requests containing malicious SQL payloads in the 'id_to_modify' field.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams must prioritize the application of vendor updates to remediate this SQL injection flaw. Failure to act may expose the organization to data integrity risks and potential regulatory non-compliance.

---METADATA---
VENDOR: Infor
PRODUCT: Kados R10 GreenBee
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Kados R10 GreenBee contains an SQL injection vulnerability in the mng_profile_id parameter, enabling attackers to manipulate database queries.

Executive Summary:
An SQL injection vulnerability in Infor Kados R10 GreenBee exposes the backend database to unauthorized manipulation and potential data breach.

Vulnerability Details

CVE-ID: CVE-2019-25690

Affected Software: Infor Kados R10 GreenBee

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The application fails to properly sanitize the mng_profile_id parameter, allowing an attacker to inject arbitrary SQL statements. This vulnerability requires authenticated access to the specific interface, though the risk remains high due to the potential for privilege escalation.

Business Impact

A successful exploit could allow an attacker to bypass authentication or extract sensitive profile data from the database. The CVSS score of 8.2 underscores the severity, necessitating prompt remediation to avoid reputational damage and unauthorized system access.

Remediation Plan

Immediate Action: Update the affected Kados R10 GreenBee installation to the latest version provided by the vendor to remediate the input validation flaw.

Proactive Monitoring: Review application and database access logs for anomalous SQL activity originating from user profiles.

Compensating Controls: Use a Web Application Firewall (WAF) to filter out requests containing suspicious SQL syntax within the mng_profile_id parameter.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The vulnerability poses a high risk to database security. IT administrators must ensure that all security patches are applied and that access controls are reviewed to limit the potential impact of a compromised account.

---METADATA---
VENDOR: Infor
PRODUCT: Kados R10 GreenBee
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Kados R10 GreenBee is vulnerable to SQL injection via the menu_lev1 parameter, allowing unauthenticated attackers to execute arbitrary database queries.

Executive Summary:
An unauthenticated SQL injection vulnerability in Infor Kados R10 GreenBee permits remote attackers to compromise database integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2019-25688

Affected Software: Infor Kados R10 GreenBee

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a classic SQL injection vulnerability occurring in the menu_lev1 parameter. The flaw is exploitable by unauthenticated remote attackers who can inject malicious SQL commands to manipulate backend database operations.

Business Impact

Successful exploitation allows unauthorized access to sensitive information stored within the database, potentially leading to full data exfiltration or unauthorized administrative modifications. With a CVSS score of 8.2 (High), this vulnerability represents a significant risk to organizational data integrity and compliance requirements.

Remediation Plan

Immediate Action: Consult the official vendor security advisory to identify and apply the necessary patches or security updates to the Kados R10 GreenBee environment.

Proactive Monitoring: Implement database query logging and monitor for unusual query patterns or syntax errors that indicate injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict input validation rules to block malicious SQL payloads targeting the menu_lev1 parameter.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the ability for unauthenticated attackers to interact directly with the database, immediate action is required. Organizations should prioritize patching or applying virtual mitigations to prevent unauthorized access to the underlying data store.