Vulnerabilities

Tenda NVR_4H CH3 v2.1 running firmware V27.5.58.6 contains a hardcoded cryptographic key embedded in the device firmware. An attacker who extracts the key — for example from a downloadable firmware image or via the public proof-of-concept published on GitHub — could use it to defeat the device's cryptographic protections, such as decrypting captured traffic, forging authenticated sessions, or bypassing encryption depending on where the key is used. This affects organizations and home users deploying this Tenda network video recorder model, which is typically used for IP camera surveillance in SMB and residential settings. A public PoC exists, but the CVE is not in the CISA KEV catalog and there is no confirmed evidence of in-the-wild exploitation at this time.

Do: Check Tenda's official support site for a firmware update for the NVR_4H CH3 and apply it if one addresses this issue; Tenda has not stated a fixed version. In the meantime, remove the NVR from direct internet exposure (place it behind a VPN or firewall), rotate any credentials configured on the device, and monitor logs for unexpected logins or configuration changes. Because a hardcoded key cannot be changed by configuration, isolation and patching are the primary mitigations.

kaiten versions from 57.192.20 up to (but not including) 57.214.26 are vulnerable to SQL injection because dynamic SQL statements are constructed without adequate input validation and without parameterized queries or stored procedures. An attacker can inject crafted input into a vulnerable parameter, causing the application to execute attacker-influenced SQL against the backend database. Successful exploitation could allow reading or modifying sensitive data, bypassing authentication, or, depending on database configuration, executing further attacks against the underlying server. All deployments running the affected version range are exposed wherever the vulnerable input is reachable, and a public proof-of-concept is available on GitHub, lowering the barrier for attackers. The flaw is not yet in CISA's Known Exploited Vulnerabilities catalog and no confirmed in-the-wild exploitation is documented, but the public PoC means active abuse is plausible.

Do: Upgrade kaiten to version 57.214.26 or later as soon as it is available. Until patched, restrict access to the affected functionality and apply WAF or database-layer rules to filter common SQL injection patterns. Review database and application logs for anomalous queries or unexpected data access that could indicate exploitation attempts.

IBM Langflow OSS versions 1.0.0 through 1.10.0 allow a low-privileged attacker to submit workflow components containing socket or urllib imports, which the server executes as arbitrary Python code with root privileges (UID=0) inside the Langflow container. The built-in validation scanner incorrectly returns 'validated': true for these malicious components, giving operators a false sense that submitted flows are safe. Successful exploitation enables AWS credential theft via IMDSv1 SSRF using the instance's full IAM role permissions, arbitrary file exfiltration from the container filesystem, and lateral movement to internal services such as PostgreSQL and Redis on the Docker network. Anyone running a self-hosted Langflow server in the affected range that permits untrusted or semi-trusted users to build and submit flows is affected. The flaw is rated critical (CVSS 9.6), but no public proof-of-concept, known in-the-wild exploitation, or CISA KEV listing exists at this time.

Do: Upgrade IBM Langflow OSS to a version newer than 1.10.0 as soon as IBM releases a fix, and check the IBM PSIRT advisory for the patched build. Do not rely on the component validator's 'validated': true signal — treat all user-submitted components as untrusted and restrict who can create or import flows. Harden the environment by running the container as a non-root user, enforcing IMDSv2 (disable IMDSv1) on cloud hosts, segmenting the Docker network from databases like PostgreSQL/Redis, and rotating AWS credentials and other secrets if untrusted flows were ever executed.

Cisco AsyncOS Software for Cisco Secure Email Gateway contains a SQL injection flaw (CWE-89) in its email parsing logic, caused by insufficient validation of message content. An unauthenticated, remote attacker can trigger it simply by sending a crafted email containing malicious SQL statements through an affected gateway, with no user interaction required. Successful exploitation allows arbitrary SQL execution that escalates to arbitrary operating-system command execution with root privileges, fully compromising the appliance and all mail flowing through it. Any organization running an affected version of Cisco Secure Email Gateway is impacted, and because these appliances sit on the inbound mail path they are inherently reachable over the network. There is no known public proof-of-concept, the flaw is not on the CISA KEV list, and no in-the-wild exploitation has been reported to date, though the CVSS 9.8 rating makes patching urgent.

Do: Upgrade to the fixed AsyncOS release listed in the corresponding Cisco PSIRT advisory as soon as possible, since the flaw is unauthenticated, requires no user interaction, and yields root. Until patched, apply any Cisco-documented workarounds and tightly restrict which hosts can submit mail to the gateway where operationally feasible. Review mail and system logs on these appliances for anomalies such as SQL errors in parsing, unexpected processes, or unexplained outbound connections that could indicate exploitation attempts.

FlowiseAI Flowise up to version 3.0.2 contains a server-side request forgery (SSRF) flaw in the Evaluations Endpoint, specifically in the axios.post call within packages/server/src/controllers/evaluations/index.ts. A remote attacker who manipulates the Host or X-Forwarded-Proto headers can trick the server into issuing requests toward attacker-influenced destinations, potentially reaching internal services, cloud metadata endpoints, or other network resources reachable from the Flowise host. The CVSS 4.0 vector indicates low privileges are required (PR:L), so an attacker needs at least limited authenticated access to the Flowise instance, and overall impact is rated low (2.1). Only Flowise versions that are no longer supported by the maintainer are affected, and a public exploit reference exists as a GitHub issue on the Flowise repository. EPSS is very low (0.2%, 12th percentile), the issue is not in the CISA KEV catalog, and no active exploitation in the wild has been reported.

Do: Upgrade Flowise to version 3.1.3 or later, which contains the patch (commit 700137738bcaebefd4709021f6d6b0abcd7df0ac); since affected versions are unsupported, running them long-term is not viable. If upgrading is delayed, restrict access to the evaluations endpoint to trusted authenticated users, avoid blindly trusting Host/X-Forwarded-Proto headers from untrusted proxies, and egress-filter the Flowise server so it cannot reach internal services or metadata endpoints. Review server logs for unexpected outbound requests originating from the evaluations controller as evidence of exploitation attempts.

S2OPC through version 1.7.3 contains a null pointer dereference (CWE-476) in msg_subscription_publish_bs__alloc_notification_message_items(), a code path that builds publish notifications for OPC UA subscriptions. If the heap allocation for a DataChangeNotification fails, the error state is clobbered by a subsequent successful allocation for an EventNotificationList, so the original failure goes unhandled and the null pointer is later dereferenced, terminating the server process. An authenticated attacker (PR:L) on a session with both data-change and event subscriptions can deliberately induce heap allocation failures — for example via memory exhaustion — to crash the server, affecting only availability (VA:H, CVSS 4.0 medium, 6.0). Anyone operating an S2OPC-based OPC UA server at or below 1.7.3 is affected, which is common in industrial and embedded deployments. A public PoC exists on GitHub, but the flaw is not in the CISA KEV catalog and there are no reports of in-the-wild exploitation.

Do: Upgrade to a S2OPC release newer than 1.7.3 as soon as the vendor ships a fix, since no fixed version is listed in the current advisory. In the interim, restrict OPC UA access (TCP 4840 and secure endpoints) to trusted engineering networks, enforce authentication with least-privilege user roles so untrusted clients cannot hold subscriptions, and monitor server memory usage and process restarts for signs of heap-exhaustion DoS. Validate that no internet-facing S2OPC servers expose sessions combining data-change and event subscriptions to untrusted users.

The ALSA Project's alsa-lib library, through version 1.2.16.1, contains an off-by-one stack buffer overflow (CWE-193) in the __snd_ctl_ascii_elem_id_parse() function: when parsing a control-element identifier whose name= field is 64 or more characters, it writes a single byte past a 64-byte stack buffer. The flaw is triggered when a calling program parses an attacker-supplied string, such as a malicious saved ALSA state file loaded via tools like alsactl restore, or an overly long control-element name passed as a command-line argument to utilities such as amixer. The overflow can corrupt adjacent stack memory and crash the calling process; given the one-byte write scope and the CVSS 4.0 base score of 4.8 (local attack vector, privileges required, low integrity and availability impact, no confidentiality impact), denial of service is the realistic outcome and reliable code execution is unlikely. Virtually any Linux system using the standard ALSA user-space library is affected, though exploitation requires local access and privileges on the target. A public proof-of-concept exists on GitHub, but the flaw is not listed in CISA's KEV catalog and there is no evidence of real-world exploitation.

Do: Upgrade to a patched alsa-lib package as soon as your distribution ships one newer than 1.2.16.1, and track your vendor's security advisories for the fix. In the meantime, ensure saved ALSA state files (e.g., /var/lib/alsa/asound.state) are root-owned and not writable by untrusted local users, and do not feed untrusted control-element identifier strings to ALSA utilities such as alsactl or amixer. Because the flaw is local, requires privileges, and primarily causes a crash, it can be handled through routine patching rather than emergency measures.

Flowise versions before 3.1.4 contain a missing-authorization flaw (CWE-862) in the /api/v1/text-to-speech/abort endpoint, which accepts user-supplied chatflowId and chatId values without verifying that the requester owns the session. An unauthenticated remote attacker who knows or guesses valid identifiers can submit abort requests that terminate other users' active chatflow predictions, causing targeted service disruption. The impact is limited to availability of individual chat sessions (CVSS 4.0: 6.3, medium) with no confidentiality or integrity impact. Anyone running a self-hosted Flowise instance on a version prior to 3.1.4, especially one exposed to untrusted networks, is affected. Exploitation status: a public advisory/PoC reference exists, EPSS is very low (0.2%, 16th percentile), and the flaw is not in the CISA KEV catalog, so no in-the-wild exploitation is known.

Do: Upgrade Flowise to version 3.1.4 or later, where ownership verification for the abort endpoint is enforced. If immediate patching is not possible, place Flowise behind an authenticating reverse proxy or restrict network access so unauthenticated callers cannot reach /api/v1/text-to-speech/abort. Review application logs for abort requests referencing chatflowId/chatId values not associated with legitimate sessions as an indicator of abuse.

The Events Calendar WordPress plugin is vulnerable to unauthenticated remote code execution (CWE-502, unsafe deserialization) in all versions up to and including 6.17.4 via the is_safe_widget_instance function, whose protection can be bypassed because PHP fires magic methods during pre-parse while enable_rendering_widget_copied() forges a valid wp_hash integrity attribute before unserialize() is reached. The flaw is reachable without authentication or approval because the plugin's V2 single-event template runs do_blocks() over buffered comment HTML, and WordPress returns a moderation-hash URL that lets an unauthenticated commenter immediately view their own still-pending comment, delivering attacker-injected block markup to the vulnerable code path before moderation occurs. Successful exploitation gives an unauthenticated attacker arbitrary code execution on the web server with full confidentiality, integrity, and availability impact. Any site running a vulnerable version is affected, but only when comments are enabled and visible on events. No public proof-of-concept is known, the issue is not in CISA's KEV catalog, and no in-the-wild exploitation has been confirmed.

Do: Update The Events Calendar to the latest available release (any version newer than 6.17.4) as soon as possible. Until patched, disable comments on events or prevent them from being publicly visible, since exploitation requires comments to be enabled and viewable on event pages. Review logs for pending comments submitted to events and unexpected widget/serialized data, and treat comment moderation queues on event posts with suspicion.

CVE-2026-85706 is a path traversal flaw (CWE-35) in GitLab Community Edition and Enterprise Edition in which the repository commits API does not properly confine file paths and does not enforce authentication, allowing an unauthenticated attacker to read arbitrary files from the GitLab server. It is triggered by sending a crafted unauthenticated request to the commits API that supplies traversal sequences moving outside the intended repository path. An attacker gains the ability to read arbitrary files on the host, which can expose configuration files, certificates, and stored credentials or keys; related reporting on the recent GitLab patch wave also notes credential theft and code execution flaws, though this CVE itself is the file-read issue. All self-managed GitLab CE and EE deployments are in scope, and CISA did not publish specific affected version ranges in this data. The flaw was added to CISA's KEV catalog on 2026-09-11 and is being actively probed and exploited in the wild within a day of disclosure, with three public proof-of-concept repositories available; ransomware use is not yet confirmed.

Do: Upgrade GitLab CE/EE to the patched release identified in GitLab's security advisory (no specific fixed version number is provided in this data), prioritizing internet-facing instances in line with CISA BOD 26-04; if patching is not immediately possible, restrict exposure and review access logs for unauthenticated requests to the commits API containing path traversal sequences. Because arbitrary file read can expose server-side secrets, inventory and rotate credentials, tokens, and keys stored on or reachable by affected GitLab hosts.

CVE-2026-89013 is an authorization bypass vulnerability (CWE-863) in Dolibarr ERP/CRM that allows unauthenticated attackers to read arbitrary files from the server. An attacker sends a request to htdocs/document.php or htdocs/viewimage.php with the hashp parameter set to "shared", which skips token validation while still satisfying the authorization condition. Successful exploitation grants access to application logs, uploaded business documents, database backups containing password hashes, and files belonging to other multicompany entities. All deployments running the affected version range (23.0.4 before 24.0.1) are impacted, particularly self-hosted instances reachable from the internet. No public proof-of-concept is known, the flaw is not in CISA KEV, and no confirmed in-the-wild exploitation has been reported.

Do: Upgrade to Dolibarr 24.0.1 or later, which fixes the bypass. As an interim mitigation, restrict or filter requests to document.php and viewimage.php at the reverse proxy/WAF layer, and review access logs for requests carrying hashp=shared. Because exposed database backups contain password hashes, consider rotating credentials if sensitive backups were reachable.

Dolibarr 24.0.0 before 24.0.1 is affected by a case-sensitivity flaw (CWE-178) in the sqlfilters parameter of its API: the denylist that hides protected database fields checks field names case-sensitively, while database column resolution is case-insensitive. An authenticated API user can supply uppercase variants of denylisted field names inside prefix-matching predicates, turning the query responses into a boolean oracle that leaks hidden fields. By repeatedly probing, the attacker can recover full password hashes for any user account, including administrator accounts. All deployments running Dolibarr 24.0.0 (or any affected 24.0.x release before 24.0.1) with the API exposed to authenticated users are affected. No public proof-of-concept is known, the issue is not in CISA's KEV catalog, and there are no confirmed reports of exploitation in the wild.

Do: Upgrade Dolibarr to 24.0.1 or later. Until patched, restrict the REST API to trusted authenticated users and consider disabling or filtering use of the sqlfilters parameter; because the flaw can expose password hashes, ensure strong password hashing and be prepared to rotate credentials if API access was shared with untrusted parties.

CVE-2026-36392 is a stored cross-site scripting (XSS) vulnerability in FairSketch Rise CRM version 3.9.6. An authenticated administrator injects arbitrary JavaScript into an item's title; the payload is stored server-side and executes in the browser of any client user who later visits the store page. Successful injection can lead to session hijacking, account takeover of client users, and phishing. Organizations running self-hosted Rise CRM 3.9.6 with client users browsing the store are affected. The flaw has not yet received a CVSS score and is not in CISA KEV, but one public proof-of-concept reference exists, though no confirmed in-the-wild exploitation is reported.

Do: Upgrade Rise CRM to a release newer than 3.9.6 once the vendor publishes a fix, and check the vendor changelog for the patched version. Until patched, ensure item titles are HTML-encoded on output, restrict item-title editing to trusted administrators, and audit existing store item titles for injected scripts.

knowns versions before 0.31.0 contain a path traversal flaw (CWE-73, External Control of File Name or Path) in the /api/opencode proxy endpoint, which fails to validate the x-opencode-directory request header. An unauthenticated remote attacker can send a crafted header containing arbitrary directory paths, causing the endpoint to perform file operations outside the intended project root on the host system. Depending on the permissions of the service process, this can allow reading, writing, or otherwise manipulating files anywhere on the host, which the critical 9.3 CVSS 4.0 score reflects with high ratings for confidentiality, integrity, and availability impact. Anyone running an affected version of knowns with the opencode proxy endpoint reachable over the network is affected. There are currently no reports of in-the-wild exploitation, no known public proof-of-concept, and the issue is not in CISA's Known Exploited Vulnerabilities catalog.

Do: Upgrade to knowns 0.31.0 or later, where the x-opencode-directory header is properly validated. If upgrading is not immediately possible, restrict network access to the /api/opencode endpoint (e.g., via reverse proxy rules), strip or validate the x-opencode-directory header, and run the service with least-privilege filesystem permissions. Administrators should also review host file integrity on exposed instances for signs of unexpected modifications.

The miniOrange 2FA WordPress plugin deletes site options whose names are taken directly from unauthenticated request input without first validating a transaction, a missing-authorization flaw (CWE-862). Any unauthenticated visitor can therefore send a crafted request that deletes arbitrary WordPress options on a vulnerable site. By deleting key options, an attacker can lock every administrator out of the dashboard or deactivate the miniOrange 2FA plugin(s) on the site, defeating two-factor enforcement; this is reflected in the critical CVSS 3.1 score of 10.0 with scope-changed, high integrity and availability impact. All WordPress sites running an affected version — before 6.3.1 or before 19.3 depending on the distribution's version line — are affected. There is no known public proof-of-concept, the flaw is not in CISA KEV, and no in-the-wild exploitation has been reported.

Do: Update the miniOrange 2FA plugin urgently: install version 6.3.1 or later (or version 19.3 or later on the other distribution's version line, per the branch you run). Because the flaw is exploitable by any unauthenticated visitor and can fully lock administrators out, if you cannot patch immediately consider temporarily deactivating the plugin or blocking unauthenticated requests that trigger option deletion at your WAF. After patching, verify that two-factor enforcement is active and that important site options (including administrator and 2FA settings) were not deleted.

CVE-2026-0303 is a code execution flaw in Checkov, Palo Alto Networks' open-source Infrastructure-as-Code scanner sold as part of Prisma Cloud, arising from functionality being included from an untrusted control sphere (CWE-829). It is triggered when Checkov scans a directory containing an attacker-controlled configuration file, for example a cloned third-party repository or downloaded module, and the attack requires local access plus user interaction, which is why the CVSS 4.0 base score is low (2.4) despite code execution impact. An attacker who plants the malicious file gains arbitrary code execution in the context of the scanning process, typically a developer workstation or CI/CD runner, and the scoring's high impact on subsequent systems suggests compromise could propagate to pipelines and infrastructure reachable from that machine. Anyone running Checkov against directories containing untrusted content is affected, while teams scanning only trusted internal repositories face little practical risk; the provided data includes no affected or fixed version numbers. There are no reports of in-the-wild exploitation (not in CISA KEV, and exploitation is scored as unreported), but a public proof-of-concept is available on GitHub.

Do: Check the Palo Alto Networks security advisory for the patched Checkov release and upgrade the standalone CLI or Prisma Cloud-bundled scanner when a fixed version is published, since no version numbers were provided in this data. Until then, avoid running Checkov on untrusted repositories or modules, or confine such scans to sandboxed CI jobs with minimal credentials. Review whether your pipelines scan third-party code and consult the public PoC (github.com/YonLiud/CVE-2026-0303) to validate exposure safely.

CVE-2026-18351 is an unauthenticated arbitrary file upload flaw in the Drag and Drop File Upload for Elementor Forms WordPress plugin, present in all versions up to and including 1.6.0. The is_file_type_valid() function accepts the attacker-controlled 'type' parameter as regex keys in the MIME allowlist, so an attacker can bypass the extension blacklist by uploading a file whose extension, after sanitize_file_name() normalization, resolves to a PHP extension. Because uploads reach the elementor_file_upload function with no authentication or user interaction required, an unauthenticated remote attacker can upload executable PHP files and achieve remote code execution on the server (CVSS 3.1: 9.8 critical). Any WordPress site running the plugin at version 1.6.0 or earlier is affected, particularly sites where the WordPress uploads directory is web-accessible and PHP execution is not blocked. As of this writing, there is no known public proof-of-concept, the issue is not in the CISA KEV catalog, and no in-the-wild exploitation has been confirmed.

Do: Update the Drag and Drop File Upload for Elementor Forms plugin to the latest patched release (any version newer than 1.6.0) as soon as it is available. Until then, inspect the uploads directory for unexpected or recently created PHP files, consider temporarily deactivating the plugin, and enforce a WAF rule or server configuration that blocks PHP execution in the uploads directory. Continue monitoring for a public proof-of-concept, since the technical details (unauthenticated file upload to RCE) make opportunistic mass scanning likely once exploited code appears.

Open WebUI versions 0.6.41 until 0.11.1 contain an authentication flaw in the user-lookup functions get_user_by_oauth_sub and get_user_by_scim_external_id (backend/open_webui/models/users.py): on SQLite, their JSON 'contains' matching compiles to SQL LIKE substring matching, leaving percent (%) and underscore (_) characters unescaped as LIKE wildcards. An OAuth subject or SCIM external ID containing these wildcard characters can therefore resolve to a different stored identity — potentially an administrator account — and the attacker is issued that account's session, effectively an authentication bypass that grants the privileges of the matched account. Exploitation requires unusual conditions (an attacker-controllable identity value with wildcard characters that collides with another account, e.g. an admin), reflected in the high attack complexity of the 8.1 High CVSS score. Only deployments using the SQLite backend with OAuth or SCIM login are affected; PostgreSQL deployments are not. No public proof-of-concept, CISA KEV listing, or known in-the-wild exploitation exists as of this analysis.

Do: Upgrade to Open WebUI 0.11.1 or later, which escapes the wildcard matching. If immediate upgrade is not possible, either migrate the backend to PostgreSQL (not affected) or restrict/disable OAuth and SCIM logins, and check whether any user's OAuth sub or SCIM external ID contains '%' or '_' characters that could collide with other accounts — especially administrators. Review active sessions on privileged accounts for logins you cannot attribute.

GPAC v26.07.0, an open-source multimedia framework, contains an out-of-bounds read (CWE-125) in the gf_dm_get_chunk_data function in src/utils/downloader.c. The flaw is triggered when GPAC's HTTP downloader processes a crafted HTTP request/response, for example when a user opens or streams a remote media URL under an attacker's control, causing the application to crash. The impact is limited to denial of service — there is no indication of information disclosure, code execution, or integrity impact (CVSS 3.1: 6.5, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Users and automated pipelines running GPAC 26.07.0 that fetch content over HTTP are affected; the issue is fixed in upstream commit 2fd5a06ab226767900fd86edb5a1e8bfc1010640. A public proof of concept exists via a GitHub issue tracker entry, but EPSS is very low (0.2%, 16th percentile), the CVE is not in CISA's KEV, and no exploitation in the wild is known.

Do: Upgrade GPAC to any build containing fix commit 2fd5a06ab226767900fd86edb5a1e8bfc1010640 (post-26.07.0) or apply the patch to downstream packages. Until patched, avoid opening or streaming remote/untrusted HTTP URLs in GPAC and restrict automated pipelines from fetching media from untrusted sources. The flaw is denial-of-service only, so prioritize it below confidentiality/integrity issues, but monitor crashes in downloader code as an indicator of attempted triggering.

PbootCMS versions 3.2.0 through 3.2.5 contain a SQL injection flaw in the User/mod interface used for editing user accounts. An authenticated user can send crafted parameters to that endpoint, and the injection lets the request write to arbitrary user account fields rather than only the intended ones. By modifying another account's password or role, the attacker can take over higher-privileged accounts, including administrators. Any site running PbootCMS 3.2.0-3.2.5 is affected, with exploitation requiring an authenticated session on the CMS. The flaw has a public proof-of-concept on GitHub, but it is not yet in CISA KEV, has no CVSS score, and there are no confirmed reports of in-the-wild exploitation.

Do: Upgrade to the latest PbootCMS release newer than 3.2.5 (check the project's GitHub for the current fixed version, as none is specified in the advisory data). Until patched, restrict access to the admin User/mod interface to trusted accounts, apply least-privilege to CMS user roles, and review recent account changes for unexpected password or role modifications. Use the referenced public proof-of-concept as a reference for building detection rules in WAF or logging pipelines.

CVE-2026-73786 is a denial-of-service flaw in the web-based management interface of HPE Aruba ClearPass Policy Manager (CPPM), HPE's network access control (NAC) platform. An unauthenticated remote attacker can trigger it by sending malicious requests to the vulnerable management interface, with no credentials or user interaction required. Successful exploitation degrades performance and causes instability of the CPPM server, impacting availability only — there is no confidentiality or integrity impact per the CVSS vector. Organizations running affected CPPM deployments are in scope, though the affected version ranges are not specified in the available advisory data. Exploitation has not been observed: the flaw is not in CISA's KEV and no public proof-of-concept is known.

Do: Review whether your CPPM web management interface is reachable from untrusted networks and restrict access to trusted management networks or via VPN/firewall rules as an interim mitigation. Monitor the HPE-Aruba security advisory for the affected version ranges and patched releases (not included in this data) and apply the vendor update promptly once published, since no public PoC or in-the-wild exploitation is currently known.

CVE-2026-67401 is a critical SQL injection (CWE-89) in the EmailTrack component of cPanel, the widely used hosting control panel. An attacker holding any mail-enabled account on the server can reach the vulnerable component over the network with low privileges and no user interaction (CVSS: AV:N/AC:L/PR:L/UI:N), and the injection crosses a privilege boundary (Scope: Changed) to achieve remote code execution as root. Successful exploitation yields full compromise of the host — arbitrary commands as root with complete access to all hosted data — so every site, mailbox and account on an affected server is exposed. All cPanel deployments with mail enabled are potentially affected; the available data does not specify exact vulnerable version ranges, which are provided in WebPros security advisory AV26-908. Exploitation has not been confirmed in the wild (not in CISA KEV), but two public proof-of-concept exploits are already on GitHub, making near-term exploitation likely.

Do: Upgrade cPanel to the patched release identified in WebPros advisory AV26-908 (exact fixed version numbers are not given in the available data), prioritizing internet-facing servers that host mail-enabled accounts. Until patched, restrict access to the EmailTrack component and audit mail-enabled accounts and logs for suspicious database queries or unexpected root-level processes, since public PoC exploits are already available.

CVE-2026-79617 is an incorrect permission assignment for a critical resource (CWE-732) in the Pardus LightDM Greeter, the display-manager login component developed by TÜBİTAK BİLGEM for the Pardus Linux distribution. The flaw stems from incorrectly configured access controls, meaning a resource used by the greeter is not correctly permissioned; a local attacker with low privileges can trigger the issue without user interaction (AV:L/PR:L/UI:N). The high confidentiality and integrity impact (C:H/I:H) indicates the attacker can gain elevated, likely root-level, access on the local machine. Any system running Pardus LightDM Greeter before version 0.4.15 is affected, primarily Pardus desktop deployments. There is a public proof-of-concept reference (github.com/alpernae/CVE-2026-79617), but the issue is not yet in CISA KEV and no confirmed in-the-wild exploitation is reported.

Do: Upgrade Pardus LightDM Greeter to version 0.4.15 or later via the Pardus package repositories (apt update && apt upgrade). Verify the installed greeter package version on affected machines, prioritize shared or multi-user systems where unprivileged users have local access, and review the public PoC repository (github.com/alpernae/CVE-2026-79617) for details on which resource permissions to check if patching is delayed.

Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing authenticated users to read arbitrary files on the server and trigger server-side HTTP requests (SSRF), a file/path handling flaw tracked as CWE-73. An attacker submits crafted markdown image syntax in checkout acceptance notes; the syntax survives HTML escaping, is expanded by the CommonMark parser, and the resulting image reference is fetched by laravel-mail-auto-embed using file_get_contents or curl, so the target can be a local file or an attacker-chosen URL. A low-privileged authenticated user gains arbitrary file read (e.g., exfiltrating the .env file, which contains the Laravel APP_KEY and other secrets) and can probe internal services or reach external URLs via the server-side request. All Snipe-IT deployments running any version prior to 8.7.0, where authenticated users can submit notes on checkout acceptance, are affected; the flaw is network-reachable with low privileges required, rated 8.4 High under CVSS 4.0. No public proof-of-concept or confirmed in-the-wild exploitation is currently known, and the issue is not in the CISA KEV catalog.

Do: Upgrade to Snipe-IT 8.7.0 or later, which fixes sanitization of markdown image syntax in note fields. As interim mitigations, restrict or strip markdown image syntax from acceptance notes, limit outbound HTTP connectivity from the Snipe-IT server to block SSRF callbacks, and verify that the web server user cannot read more configuration than necessary; if compromise is suspected, rotate the APP_KEY and any other secrets stored in .env.

mrubyc, a lightweight Ruby VM designed for embedding in microcontroller and IoT firmware, contains a null pointer dereference (CWE-476) in the op_enter() handler of src/vm.c in all versions through 4.0.0. The flaw is triggered when the VM processes a crafted .mrb bytecode file containing an OP_ENTER instruction placed at the top level, causing a NULL dereference during execution. An attacker who can supply such bytecode to an embedding application gains denial of service, since the process crashes; the CVSS 4.0 score of 6.9 (local attack vector, high availability impact) reflects an availability-only issue with no confidentiality or integrity loss. Only applications that execute untrusted or attacker-supplied bytecode in mrubyc are realistically affected, while firmware running solely its own pre-compiled bytecode is not exposed. No in-the-wild exploitation is known and the issue is absent from CISA KEV, but a public proof-of-concept is available on GitHub.

Do: No fixed version is confirmed in the available data, so monitor the mrubyc project for a patched release and update the embedded VM as soon as one is published. Until then, do not feed untrusted or third-party .mrb bytecode files into applications built on mrubyc 4.0.0 or earlier, and audit integrations for any path where user-supplied data can reach bytecode execution. Where untrusted bytecode must be processed, isolate the VM in a separate sandboxed process so a crash cannot take down the host application.

Several Newfold Digital WordPress plugins — the hosting-brand helper plugins for Bluehost, HostGator, Crazy Domains and Web.com — are vulnerable to an unauthenticated authentication bypass (CWE-287) in their bundled wp-module-data module, which is vulnerable in versions up to and including 2.9.4. The module's authenticate() callback runs on the rest_authentication_errors filter, so it is evaluated for every unauthenticated REST API request, and it verifies an HMAC-style Bearer token; when HiiveConnection::get_auth_token() returns false, the secret salt degenerates to the publicly known SHA-256 hash of an empty string (the well-known e3b0c44... digest), while every other hash input — HTTP method, request URL, raw request body and the X-Timestamp header — remains fully attacker-controlled. An unauthenticated attacker can therefore compute a valid Bearer token entirely offline, pass the token equality check, and be logged in via wp_set_current_user() as the first administrator returned by get_users(['role' => 'administrator']). This grants full administrator-level access through the REST API, including arbitrary REST operations such as creating new administrator accounts and achieving complete site takeover. All sites running WP Plugin Crazy Domains <= 2.5.2, WP Plugin Web <= 2.3.4, WP Plugin Hostgator <= 3.1.0 or WP Plugin Bluehost <= 4.17.1 are affected — predominantly sites hosted on Newfold's hosting brands — and the exploitation status is none known: there is no public proof-of-concept, the flaw is not in CISA KEV, and no in-the-wild exploitation has been reported (CVSS 3.1: 8.8 high).

Do: Upgrade all four plugins past the vulnerable thresholds — WP Plugin Crazy Domains > 2.5.2, WP Plugin Web > 2.3.4, WP Plugin Hostgator > 3.1.0, WP Plugin Bluehost > 4.17.1 — or at minimum ensure the bundled wp-module-data module is updated beyond 2.9.4; Newfold-managed hosts may apply updates automatically, so verify the running versions. Until patched, consider restricting or auditing unauthenticated access to /wp-json at the web-server or WAF layer, and review REST API logs and the users list for unauthenticated requests that authenticated as an administrator or for unfamiliar administrator accounts created via the REST API.