summary: iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV has undefined behavior due to an invalid enum value. This issue has been patched in version 2.3.1.2.


product: iccDEV

vendor: InternationalColorConsortium

status: affected

ecosystem: software/application

metric_type: Primary

severity: medium

metric_type: Secondary

part: a

product: iccdev

vendor: color

quality: metadata-backed

recipe_kind: composed

status: Analyzed

summary: iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vulnerable to Null pointer dereference in CIccProfileXml::ParseBasic(), leading to denial of service. This issue has been patched in version 2.3.1.2.


severity: high

summary: iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below have an infinite loop in the IccProfile.cpp function, CalcProfileID. This issue is fixed in version 2.3.1.1.


platforms:
32-bit Systems
x64-based Systems

product: Windows 10 Version 1607

vendor: Microsoft

version_type: custom

product: Windows 10 Version 1809

platforms:
32-bit Systems
ARM64-based Systems
x64-based Systems

product: Windows 10 Version 21H2

product: Windows 10 Version 22H2

product: Windows 11 version 22H3

product: Windows 11 Version 23H2

platforms:
ARM64-based Systems
x64-based Systems

product: Windows 11 Version 24H2

product: Windows 11 Version 25H2

product: Windows 11 version 26H1

product: Windows Server 2012

product: Windows Server 2012 (Server Core installation)

product: Windows Server 2012 R2

ecosystem: windows/system

part: o

vendor: microsoft

summary: Improper authentication in Windows Storage allows an authorized attacker to elevate privileges locally.


product: Microsoft 365 Apps for Enterprise

product: Microsoft Office 2016

product: Microsoft Office 2019

product: Microsoft Office LTSC 2021

product: Microsoft Office LTSC 2024

business_risk: No additional source-verified CVE-specific business impact was established.

uncertainty: The Microsoft Security Response Center page for CVE-2026-21509 was returned without extractable advisory content, so product-specific mitigation details and verification criteria could not be independently confirmed there.

uncertainty: The returned authoritative material does not establish concrete fixed versions for Microsoft 365 Apps for Enterprise, Office LTSC 2021, or Office LTSC 2024.

uncertainty: The supplied NVD record uses the Office Security Releases URL as the less-than value for several product lines rather than a concrete build number.

uncertainty: No safe product-specific configuration check or inert technical test was established by the returned sources.

archetype: generic

known_ransomware_campaign_use: Unknown

notes: Please adhere to Microsoft’s recommended guidelines to address this vulnerability. Implement all final mitigations provided by the vendor for Office 2021, and apply the interim corresponding mitigations for Office 2016 and Office 2019 until the final patch becomes available. For more information please see: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21509

product: Office

required_action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

vendor_project: Microsoft

vulnerability_name: Microsoft Office Security Feature Bypass Vulnerability

product: office

summary: Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.


product: Windows 10 Version 1607

product: Windows 10 Version 1809

product: Windows 10 Version 21H2

business_risk: High-priority remediation is warranted. The vulnerability permits an unauthorized network attacker to bypass a Windows security feature; the Microsoft CVSS vector indicates potential confidentiality, integrity, and availability impact, with user interaction required. CISA records active exploitation and requires prioritization under KEV guidance.

claim: Microsoft lists affected Windows 10, Windows 11, and Windows Server products, including the affected product/build ranges reflected in the NVD change record.

claim: Affected versions are specified as builds below the applicable thresholds, including Windows 10 1607 below 10.0.14393.8868, Windows 10 1809 below 10.0.17763.8389, Windows 10 21H2 below 10.0.19044.6937, Windows 10 22H2 below 10.0.19045.6937, and corresponding Windows 11 and Windows Server ranges.

claim: The vulnerability description states that Windows Shell allows an unauthorized attacker to bypass a security feature over a network; the CNA CVSS vector indicates no privileges, user interaction required, and high confidentiality, integrity, and availability impact.

kind: exposure

claim: Comparing an installed Windows build with the authoritative affected-version upper bound is an inert validation of whether the host is below or at/above the published threshold; the sources do not specify a separate vendor verification procedure.

kind: verification

exposure_conditions: The affected Windows product and build are below the applicable Microsoft fixed-build threshold.

exposure_conditions: The vulnerable Windows Shell component is reachable through a network attack path.

exposure_conditions: exploitation may require user interaction, as indicated by the CVSS vector.

exposure_conditions: CISA lists CVE-2026-21510 in the Known Exploited Vulnerabilities Catalog; ransomware use is listed as unknown.

remediation_steps: Apply the applicable Microsoft security update or vendor mitigation for CVE-2026-21510, prioritizing internet-connected and actively targeted systems.

remediation_steps: For Windows 10 Version 1607 and Windows Server 2016, update to build 10.0.14393.8868 or later.

remediation_steps: For Windows 10 Version 1809 and Windows Server 2019, update to build 10.0.17763.8389 or later.

remediation_steps: For Windows 10 Version 21H2, update to build 10.0.19044.6937 or later; for Windows 10 Version 22H2, update to build 10.0.19045.6937 or later.

remediation_steps: For Windows 11 Version 22H3 or 23H2, update to build 10.0.22631.6649 or later.

remediation_steps: For Windows 11 Version 24H2, update to build 10.0.26100.7840 or later; for Version 25H2, update to build 10.0.26200.7840 or later; for Version 26H1, update to build 10.0.28000.1575 or later.

remediation_steps: For Windows Server 2012, update to build 6.2.9200.25923 or later; for Windows Server 2012 R2, update to build 6.3.9600.23022 or later.

remediation_steps: For Windows Server 2022, Windows Server 2022 23H2, and Windows Server 2025, apply updates meeting the corresponding fixed builds listed by Microsoft/NVD: 10.0.20348.4773, 10.0.25398.2149, and 10.0.26100.32370 or later, respectively.

status: complete

uncertainty: The returned Microsoft advisory page requires JavaScript, so detailed Microsoft mitigation instructions and update article identifiers were not independently extracted.

uncertainty: The NVD record contains a truncated product list in the supplied data; the NVD change record shows additional Windows Server products and duplicate/variant entries.

uncertainty: The sources establish fixed build thresholds but do not provide a dedicated, product-specific safe verification procedure.

uncertainty: The KEV record indicates active exploitation but does not establish the attacker techniques, affected deployments, or ransomware usage for this CVE.

verification_steps: Identify the Windows product, edition, architecture, and installed OS build on each potentially affected host.

verification_steps: Compare the installed build with the applicable fixed-build threshold above; a build below the threshold should remain treated as affected.

verification_steps: Confirm through the organization’s approved patch-management records that the applicable Microsoft security update or mitigation was successfully deployed.

verification_steps: Recheck after reboot or maintenance completion if the organization’s patch process requires reboot completion for the update to become effective.

verification_steps: Do not treat network reachability testing or exploit simulation as necessary for routine validation.

product: Windows

vulnerability_name: Microsoft Windows Shell Protection Mechanism Failure Vulnerability

summary: Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.


product: Microsoft Office LTSC for Mac 2021

product: Microsoft Office LTSC for Mac 2024

product: Microsoft SharePoint Enterprise Server 2016

product: Microsoft SharePoint Server 2019

product: Microsoft SharePoint Server Subscription Edition

product: Microsoft Word 2016

summary: Deserialization of untrusted data in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.


product: Azure DevOps Server 2022

archetype: ssrf

summary: Server-side request forgery (ssrf) in Azure DevOps Server allows an authorized attacker to perform spoofing over a network.


product: Windows 10 Version 22H2

product: Windows 11 version 22H3

product: Windows 11 Version 23H2

product: Windows 11 Version 24H2

product: Windows 11 Version 25H2

product: Windows 11 version 26H1

product: Windows Server 2012

product: Windows Server 2012 (Server Core installation)

product: Windows Server 2012 R2

uncertainty: The Microsoft Security Update Guide page was returned as a JavaScript application and did not expose its security-update, mitigation, workaround, or FAQ content in the retrieved evidence. ([msrc.microsoft.com](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21513))

uncertainty: The supplied record is marked affected_data_truncated and products_truncated.

uncertainty: There is a discrepancy between the supplied record and the retrieved NVD page for some Windows 11 fixed-build values, including Windows 11 24H2; this enrichment does not resolve that discrepancy without directly accessible Microsoft update-guide data. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-21513?utm_source=openai))

uncertainty: No authoritative, concrete KB identifier or product-specific mitigation procedure was available in the returned sources.

vulnerability_name: Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability

summary: Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network.


product: Microsoft 365 Apps for Enterprise

product: Microsoft Office LTSC 2021

product: Microsoft Office LTSC 2024

business_risk: High-priority remediation. CVE-2026-21514 is a Microsoft Office Word security-feature bypass vulnerability with a CVSS 3.1 score of 7.8 (High). Exploitation requires local access and user interaction, but successful exploitation may affect confidentiality, integrity, and availability. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating observed exploitation and requiring expedited remediation for applicable organizations.

claim: Microsoft's February 10, 2026 Office security release notes list CVE-2026-21514 and provide fixed February 10 builds for Microsoft 365 Apps, Office LTSC 2021, and Office LTSC 2024 branches.

claim: Microsoft's Office for Mac update history identifies February 10, 2026 version 16.106 (build 26020821).

claim: Microsoft's official Office security release notes are the vendor source for updates containing CVE-2026-21514.

kind: remediation

claim: Verification can be performed by comparing the installed Office branch and build with Microsoft's February 10, 2026 release baselines and the Mac version 16.106 (26020821) baseline.

claim: Microsoft's Office for Mac update history provides the Mac version and build identifier 16.106 (26020821) for February 10, 2026.

exposure_conditions: The vulnerable Microsoft Office Word component is installed: Microsoft 365 Apps for Enterprise, Office LTSC 2021, Office LTSC 2024, Office LTSC for Mac 2021, or Office LTSC for Mac 2024.

exposure_conditions: An unauthorized attacker can cause or persuade a local user to interact with content or an input processed by Word.

exposure_conditions: Windows editions are affected on 32-bit and x64 systems; the listed LTSC Mac editions are also affected.

exposure_conditions: For the supplied product records, versions below Microsoft's Office security-release thresholds are affected.

remediation_steps: Deploy Microsoft's February 10, 2026 Office security updates through the organization's normal Microsoft 365 Apps or Office servicing process.

remediation_steps: For Microsoft 365 Apps for Enterprise, update each deployed servicing channel to a February 10, 2026 build that includes CVE-2026-21514, or to a later vendor-supported build. The Microsoft release notes list, among others, Current Channel 2601 build 19628.20204, Monthly Enterprise Channel 2512 build 19530.20226, Monthly Enterprise Channel 2511 build 19426.20294, Monthly Enterprise Channel 2510 build 19328.20306, Semi-Annual Enterprise Channel 2508 build 19127.20532, Semi-Annual Enterprise Channel 2502 build 18526.20714, and Semi-Annual Enterprise Channel 2408 build 17928.20776.

remediation_steps: For Office LTSC 2024 Volume Licensed, deploy at least version 2408 build 17932.20670 or a later supported security build.

remediation_steps: For Office LTSC 2021 Volume Licensed, deploy at least version 2108 build 14334.20522 or a later supported security build.

remediation_steps: For Office LTSC for Mac 2021 and Office LTSC for Mac 2024, deploy version 16.106 (build 26020821) or later. Microsoft identifies versions below 16.106.26020821 as affected.

remediation_steps: If timely patching is not possible, follow applicable Microsoft mitigations and CISA KEV/BOD 22-01 requirements; if mitigation is unavailable, discontinue use of the affected product where feasible.

uncertainty: The Microsoft Security Response Center advisory page was not machine-readable during lookup, so the detailed remediation guidance is based on Microsoft's official Office security-release notes and Office for Mac update history, together with the NVD record.

uncertainty: The supplied Windows affected-version values use Microsoft's OfficeSecurityReleases threshold rather than a single universal version. Fixed baselines therefore vary by Microsoft 365 Apps servicing channel and Office product branch.

uncertainty: The listed fixed builds are the February 10, 2026 builds documented by Microsoft as containing CVE-2026-21514; later supported builds should also contain the fix, but a complete branch-by-branch later-build matrix was not established here.

uncertainty: The evidence confirms local exploitation requiring user interaction and security-feature bypass, but does not establish a specific malicious document format, file path, exploit chain, or endpoint compromise indicator.

verification_steps: Inventory Microsoft Office product, edition, architecture, servicing channel, and installed build for affected endpoints.

verification_steps: Confirm that Word and the associated Office suite report a build at or above the applicable February 10, 2026 Microsoft security baseline, or a later supported build.

verification_steps: For Mac installations, confirm the reported Office version is 16.106 (26020821) or later.

verification_steps: Recheck the Microsoft Office security-update release notes and the Microsoft Security Update Guide for any later revisions or product-specific servicing changes.

verification_steps: Do not treat successful application launch or document opening as proof of remediation; version and update-state verification are required.

product: Office

vulnerability_name: Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability

summary: Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.


product: Azure IOT Central

severity: critical

summary: Exposure of sensitive information to an unauthorized actor in Azure IOT Central allows an authorized attacker to elevate privileges over a network.

title: Microsoft Azure Iot Central security vulnerability


product: GitHub Copilot Plugin for JetBrains IDEs

summary: Improper neutralization of special elements used in a command ('command injection') in Github Copilot allows an unauthorized attacker to execute code over a network.

title: Microsoft Github Copilot security vulnerability


product: Windows App for Mac

summary: Improper link resolution before file access ('link following') in Windows App for Mac allows an authorized attacker to elevate privileges locally.

title: Microsoft Windows App security vulnerability


product: Microsoft Visual Studio Code CoPilot Chat Extension

product: Visual Studio Code

status: Modified

summary: Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

title: Microsoft Visual Studio Code security vulnerability


product: Windows 10 Version 1607

product: Windows 10 Version 1809

product: Windows 10 Version 21H2

product: Windows 10 Version 22H2

product: Windows 11 version 22H3

product: Windows Server 2016

product: Windows Server 2016 (Server Core installation)

product: Windows Server 2019

business_risk: High. CVE-2026-21519 is a local privilege-elevation vulnerability in Windows Desktop Window Manager. Successful exploitation can provide high confidentiality, integrity, and availability impact. The vulnerability is listed in CISA's Known Exploited Vulnerabilities Catalog, so affected systems should receive expedited remediation. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-21519?utm_source=openai))

claim: CVE-2026-21519 affects specified Windows 10, Windows 11, Windows Server 2016, and Windows Server 2019 configurations below their product-specific build boundaries.

claim: The vulnerability is a local privilege-elevation issue requiring local access and low privileges, with no user interaction, as reflected by CVSS vector AV:L/AC:L/PR:L/UI:N.

claim: For each affected product configuration, the corresponding listed build boundary is the first non-affected build threshold; systems should be updated to that build or later.

claim: CISA's catalog action is to apply vendor mitigations, follow applicable BOD 22-01 guidance for cloud services, or discontinue use if mitigations are unavailable.

claim: A safe verification method is to compare the installed OS build with the applicable fixed-build threshold, without attempting to trigger the vulnerable condition.

exposure_conditions: The vulnerable Windows operating-system build must be installed.

exposure_conditions: An attacker must already have local access and authorized low-level privileges; the published CVSS vector specifies AV:L, PR:L, and UI:N. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-21519?utm_source=openai))

exposure_conditions: Affected systems include the Windows and Windows Server versions whose builds are below the applicable Microsoft security baseline listed in the NVD record. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-21519?utm_source=openai))

remediation_steps: Apply the applicable Microsoft security update for CVE-2026-21519 and ensure the operating-system build reaches or exceeds the product-specific fixed build.

remediation_steps: For the affected products represented in the supplied record, the fixed-build thresholds are: Windows 10 Version 1607 and Windows Server 2016: 10.0.14393.8868; Windows 10 Version 1809 and Windows Server 2019: 10.0.17763.8389; Windows 10 Version 21H2: 10.0.19044.6937; Windows 10 Version 22H2: 10.0.19045.6937; Windows 11 Versions 22H3 and 23H2: 10.0.22631.6649; Windows 11 Version 24H2: 10.0.26100.7840; Windows 11 Version 25H2: 10.0.26200.7840; and Windows 11 Version 26H1: 10.0.28000.1575. These thresholds correspond to the affected-version boundaries recorded by NVD. ([nvd.nist.gov](https://nvd…

remediation_steps: Prioritize remediation according to CISA's required action: apply vendor mitigations, follow applicable BOD 22-01 guidance for cloud services, or discontinue use where mitigations are unavailable. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-21519?utm_source=openai))

remediation_steps: If an affected system cannot be updated promptly, apply only vendor-documented mitigations and restrict local access according to organizational emergency-change procedures; no unsupported workaround is established by the consulted sources.

uncertainty: The Microsoft Security Update Guide page was available but its detailed content required client-side JavaScript, so the enrichment relies primarily on the NVD record, which attributes the affected-version data to Microsoft. ([msrc.microsoft.com](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21519))

uncertainty: The supplied record states that affected-product data and product mappings are truncated; additional Windows editions or architectures may therefore require separate confirmation against the complete Microsoft advisory or NVD record. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-21519?utm_source=openai))

uncertainty: No exploit reproduction, vulnerable file path, package identifier, standalone mitigation configuration, or independent patch-installation result was established by the consulted sources.

verification_steps: Record the installed Windows edition, release, architecture, and OS build using an approved asset-inventory or endpoint-management method.

verification_steps: Compare the reported build with the applicable fixed-build threshold above; treat a build below that threshold as not remediated.

verification_steps: Confirm that the applicable Microsoft security update is installed and that the system has completed any required restart or servicing operation through normal change-management records.

verification_steps: Recheck the build after remediation and retain the resulting inventory or compliance evidence. This is a non-exploitative version check, not a validation attempt against the vulnerable component.

product: Windows

vulnerability_name: Microsoft Windows Type Confusion Vulnerability

summary: Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally.


product: Microsoft Copilot Studio

summary: Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive information through network attack vector

title: Microsoft Copilot Studio security vulnerability


product: Microsoft 365 Word Copilot

summary: Improper neutralization of escape, meta, or control sequences in Copilot allows an unauthorized attacker to disclose information over a network.

title: Microsoft 365 Word Copilot security vulnerability


product: Microsoft ACI Confidential Containers

product: confcom

summary: Improper neutralization of special elements used in a command ('command injection') in Azure Compute Gallery allows an authorized attacker to elevate privileges locally.

title: Microsoft Confcom security vulnerability


summary: Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a network.


product: Azure Data Explorer

summary: Exposure of sensitive information to an unauthorized actor in Azure Data Explorer allows an unauthorized attacker to disclose information over a network.

title: Microsoft Azure Data Explorer security vulnerability


product: Windows 11 Version 23H2

product: Windows 11 Version 24H2

product: Windows 11 Version 25H2

product: Windows 11 version 26H1

product: Windows Server 2012

product: Windows Server 2012 (Server Core installation)

product: Windows Server 2012 R2

vulnerability_name: Microsoft Windows NULL Pointer Dereference Vulnerability

summary: Null pointer dereference in Windows Remote Access Connection Manager allows an unauthorized attacker to deny service locally.


product: Microsoft Exchange Server 2016 Cumulative Update 23

product: Microsoft Exchange Server 2019 Cumulative Update 14

product: Microsoft Exchange Server 2019 Cumulative Update 15

product: Microsoft Exchange Server Subscription Edition RTM

summary: User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

title: Microsoft Exchange Server security vulnerability


product: Azure IoT Explorer

summary: Binding to an unrestricted ip address in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network.


product: Azure HDInsight

summary: Improper neutralization of input during web page generation ('cross-site scripting') in Azure HDInsights allows an authorized attacker to perform spoofing over a network.

title: Microsoft Azure Hdinsight security vulnerability


product: Microsoft 365 Apps for Enterprise

product: Microsoft Office 2016

product: Microsoft Office 2019

product: Microsoft Office LTSC 2021

product: Microsoft Office LTSC 2024

product: Windows 10 Version 1607

product: Windows 10 Version 1809

product: Windows 10 Version 21H2

product: Windows 10 Version 22H2

product: Windows 11 version 23H2

summary: Double free in Windows Rich Text Edit allows an authorized attacker to elevate privileges locally.


product: Azure AI Language Authoring

summary: Deserialization of untrusted data in Azure SDK allows an unauthorized attacker to execute code over a network.


product: Azure Functions

summary: Azure Function Information Disclosure Vulnerability


product: Windows 11 version 22H3

product: Windows 11 Version 23H2

product: Windows 11 Version 24H2

product: Windows 11 Version 25H2

product: Windows 11 version 26H1

product: Windows Server 2012

product: Windows Server 2012 (Server Core installation)

product: Windows Server 2012 R2

business_risk: High. CVE-2026-21533 is a Windows Remote Desktop improper-privilege-management vulnerability that allows an authorized attacker to elevate privileges locally. It is listed in CISA's Known Exploited Vulnerabilities catalog, and the NVD record identifies active exploitation. Successful exploitation could affect confidentiality, integrity, and availability because the Microsoft CVSS vector assigns high impact to all three.

claim: The affected products include the Windows releases and build ranges shown in the supplied record, including Windows 10 Version 1607, 1809, 21H2, 22H2; Windows 11 versions 22H3, 23H2, 24H2, 25H2, 26H1; and Windows Server 2012 and 2012 R2.

claim: The vulnerability is described as improper privilege management in Windows Remote Desktop that allows an authorized attacker to elevate privileges locally.

claim: For each listed affected product, the corresponding Microsoft fixed version is the build threshold shown as excluded from the affected range in the NVD record.

claim: CISA's required action is to apply mitigations according to vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use if mitigations are unavailable.

claim: A safe verification can compare the installed Windows product and OS build against the applicable fixed-build threshold recorded by NVD; the sources do not support a specific command, script, or exploit-based test.

exposure_conditions: The affected Windows version and architecture are installed below the applicable Microsoft fixed build.

exposure_conditions: Windows Remote Desktop functionality is present and the attacker already has the authorization or local access required by the vulnerability; the sources do not establish that the issue is exploitable by an unauthenticated remote attacker.

exposure_conditions: The affected host remains unpatched or has not received an equivalent Microsoft mitigation.

remediation_steps: Prioritize remediation because the vulnerability is included in CISA's Known Exploited Vulnerabilities catalog.

remediation_steps: Apply Microsoft's security update or vendor-directed mitigation for the installed Windows release.

remediation_steps: For the affected versions represented in the supplied record, update to at least the applicable fixed build: Windows 10 Version 1607: 10.0.14393.8868; Windows 10 Version 1809: 10.0.17763.8389; Windows 10 Version 21H2: 10.0.19044.6937; Windows 10 Version 22H2: 10.0.19045.6937; Windows 11 version 22H3 and Version 23H2: 10.0.22631.6649; Windows 11 Version 24H2: 10.0.26100.7840; Windows 11 Version 25H2: 10.0.26200.7840; Windows 11 version 26H1: 10.0.28000.1575; Windows Server 2012 and Windows Server 2012 R2: 6.2.9200.25923 and 6.3.9600.23022, respectively.

remediation_steps: If a supported update or vendor mitigation cannot be deployed, follow the CISA KEV action to apply available vendor mitigations or discontinue use of the affected product where appropriate.

uncertainty: The NVD record indicates that affected-product data is truncated; the supplied record reports 21 affected data entries and 23 product matches, while only a subset is shown.

uncertainty: The returned authoritative sources do not provide a detailed technical exposure condition beyond Windows Remote Desktop and the requirement for an authorized attacker; network reachability, service configuration, exploit prerequisites, and vulnerable component details are not established.

uncertainty: The Microsoft advisory page was returned but its content required JavaScript, so update-package identifiers, KB numbers, and any Microsoft-specific mitigation or detection procedure could not be independently extracted.

uncertainty: Fixed-build thresholds are established for the listed product records, but the complete set of affected products cannot be confirmed from the truncated data.

verification_steps: Using approved asset-management or Windows servicing inventory, identify the installed Windows product, release, architecture, and OS build.

verification_steps: Compare the installed build with the applicable Microsoft fixed-build threshold; treat the host as unresolved if its build is below the threshold or the product mapping is unknown.

verification_steps: Confirm through patch-management compliance records that the Microsoft security update or documented vendor mitigation was successfully deployed; do not infer remediation solely from an attempted deployment.

verification_steps: Reassess any systems where Windows Remote Desktop is enabled or otherwise in use and where the required authorized/local access condition may exist.

product: Windows

vulnerability_name: Microsoft Windows Improper Privilege Management Vulnerability

summary: Improper privilege management in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.


product: Microsoft Teams

product: teams

summary: Improper access control in Microsoft Teams allows an unauthorized attacker to disclose information over a network.


product: Microsoft Devices Pricing Program

summary: Microsoft Devices Pricing Program Remote Code Execution Vulnerability


product: Microsoft Defender for Endpoint for Linux

summary: Improper control of generation of code ('code injection') in Microsoft Defender for Linux allows an unauthorized attacker to execute code over an adjacent network.

title: Microsoft Defender For Endpoint security vulnerability


default_status: unaffected

vendor: Unisoc (Shanghai) Technologies Co., Ltd.

status: Received

summary: In nr modem, there is a possible improper input validation. This could lead to remote denial of service with System execution privileges needed.


summary: In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed


title: In modem, there is a possible improper input validation


version: Yocto


product: Crowd Data Center

vendor: Atlassian

status: unaffected

archetype: xxe

product: crowd

vendor: atlassian

summary: This High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7.1.0 of Crowd Data Center and Server. This XXE (XML External Entity Injection) vulnerability, with a CVSS Score of 7.9, allows an authenticated attacker to access local and remote content which has high impact to confidentiality, low impact to integrity, high impact to availability, and requires no user interaction. Atlassian recommends that Crowd Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: * Crowd Data Center and Server 7.1: Upgrade to a release greater than or equal to 7.1.3 See the release notes (https://confluence.atlassian.com/crowd/crowd-release-notes-199094.html). You can download the latest version of Crowd Data Center and Server from the download center (https://www.atlassian.com/software/crowd/download-archive). This vulnerability was reported via our Atlassian (Internal) program.


product: Bamboo Data Center

product: bamboo

summary: This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.6, allows an authenticated attacker to execute malicious code on the remote system. Atlassian recommends that Bamboo Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Bamboo Data Center 9.6: Upgrade to a release greater than or equal to 9.6.24 Bamboo Data Center 10.2: Upgrade to a release greater than or equal to 10.2.16 Bamboo Data Center 12.1: Upgrade to a release greater than or equal to 12.1.3 See the release notes ([https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html]). You can download the latest version of Bamboo Data Center from the download center ([https://www.atlassian.com/software/bamboo/download-archives]). This vulnerability was reported via our Atlassian (Internal) program.

title: Atlassian Bamboo security vulnerability


summary: This Critical severity OS Command Injection vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 9.4 and a CVSS Vector of CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H allows an authenticated attacker to execute commands on the remote system, which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction. Atlassian recommends that Bamboo Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Bamboo Data Center 9.6.0: Upgrade to a release greater than or equal to 9.6.25 Bamboo Data Center 10.2: Upgrade to a release greater than or equal to 10.2.18 Bamboo Data Center 12.1: Upgrade to a release greater than or equal to 12.1.6 See the release notes ([https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html]).

title: Atlassian Bamboo security vulnerability


product: Sourcetree for Mac

version: All versions from 3.4.11 to 3.4.12 inclusive

version: All versions from 3.4.13

product: sourcetree

summary: This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.11 of Sourcetree for Mac and Sourcetree for Windows. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction. Atlassian recommends that Sourcetree for Mac and Sourcetree for Windows customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: * Sourcetree for Mac and Sourcetree for Windows 3.4: Upgrade to a release greater than or equal to 3.4.13 See the release notes (https://www.sourcetreeapp.com/download-archives). You can download the latest version of Sourcetree for Mac and Sourcetree for Windows from the download center (https://www.sourcetreeapp.com/download-archives). This vulnerability was reported via our Bug Bounty program.

title: Atlassian Sourcetree security vulnerability


product: Confluence Data Center

summary: This High severity DoS (Denial of Service) vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of Confluence Data Center. This DoS (Denial of Service) vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely disrupting services of a host connected to a network. Atlassian recommends that Confluence Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Confluence Data Center 9.2: Upgrade to a release greater than or equal to 9.2.17 Confluence Data Center 10.2: Upgrade to a release greater than or equal to 10.2.7 See the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center from the download center ([https://www.atlassian.com/software/confluence/download-archives]). This vulnerability was reported via our Penetration Testing program.

title: Atlassian Confluence Data Center security vulnerability


summary: This High severity Information Disclosure vulnerability was introduced in versions 7.17.0, 7.19.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This Information Disclosure vulnerability, with a CVSS Score of 8.2, allows an unauthenticated attacker to view sensitive information via an Information Disclosure vulnerability. Atlassian recommends that Confluence Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Confluence Data Center 9.2: Upgrade to a release greater than or equal to 9.2.22 Confluence Data Center 10.2: Upgrade to a release greater than or equal to 10.2.14 See the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center from the download center ([https://www.atlassian.com/software/confluence/download-archives]). This vulnerability was reported via our Atlassian (Internal) program.


product: Confluence Server

ecosystem: javascript/npm

summary: This Critical severity Stored XSS, PrivEsc (Privilege Escalation), and Security Misconfiguration vulnerability was introduced in versions 7.1.1, 7.4.0, 7.13.0, 7.17.0, 7.19.0, 8.0.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of Confluence Data Center and Server. This Stored XSS, PrivEsc (Privilege Escalation), and Security Misconfiguration vulnerability, with a CVSS Score of 8.6, allows an unauthenticated attacker to execute arbitrary HTML or JavaScript code on a victims browser, perform actions as a higher-privileged user, and to get into the system utilizing loopholes exposed from security best-practices being overlooked. Atlassian recommends that Confluence Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Confluence Data Center and Server 9.2: Upgrade to a release greater than or equal to 9.2.21 Confluence Data Center and Server 10.2: Upgrade to a release greater than or equal to 10.2.13 See the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]).


summary: This High severity BASM (Broken Authentication & Session Management) vulnerability known as CVE-2026-21582 was introduced in version 7.2.1 of Crowd Data Center. This BASM (Broken Authentication & Session Management) vulnerability, with a CVSS Score of 8.8, allows an unauthenticated attacker to perform actions as another user. Atlassian recommends that Crowd Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Crowd Data Center 7.2: Upgrade to a release greater than or equal to 7.2.2 See the release notes (https://confluence.atlassian.com/crowd/crowd-release-notes-199094.html). You can download the latest version of Crowd Data Center from the download center (https://www.atlassian.com/software/crowd/download-archive). This vulnerability was reported via our Penetration Testing program.

title: Atlassian Crowd Data Center security vulnerability


summary: This High severity Improper Authorization vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This Improper Authorization vulnerability, with a CVSS Score of 7.6, allows an authenticated attacker to gain unintended access and can lead to the exposure of resources or functionality, possibly providing attackers with sensitive information or even execute arbitrary code. Atlassian recommends that Bamboo Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: * Bamboo Data Center 10.2: Upgrade to a release greater than or equal to 10.2.22 * Bamboo Data Center 12.1: Upgrade to a release greater than or equal to 12.1.10 See the release notes (https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html). You can download the latest version of Bamboo Data Center from the download center (https://www.atlassian.com/software/bamboo/download-archives). This vulnerability was reported via our Penetration Testing program.

title: Atlassian Bamboo Data Center security vulnerability


product: hexpm

vendor: hexpm

version_type: git

version_type: date

vendor: hex

summary: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in hexpm hexpm/hexpm ('Elixir.HexpmWeb.SharedAuthorizationView' modules) allows Cross-Site Scripting (XSS). This vulnerability is associated with program files lib/hexpm_web/views/shared_authorization_view.ex and program routines 'Elixir.HexpmWeb.SharedAuthorizationView':render_grouped_scopes/3. This issue affects hexpm: from 617e44c71f1dd9043870205f371d375c5c4d886d before c692438684ead90c3bcbfb9ccf4e63c768c668a8; hex.pm: from 2025-10-01 before 2026-01-19.

title: Hex Hexpm security vulnerability


version_type: semver

product: hex

vendor: erlang

severity: low

summary: Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang rebar3 (r3_hex_api modules) allows Object Injection, Excessive Allocation. This vulnerability is associated with program files src/hex_api.erl, src/mix_hex_api.erl, apps/rebar/src/vendored/r3_hex_api.erl and program routines hex_core:request/4, mix_hex_api:request/4, r3_hex_api:request/4. This issue affects hex_core: from 0.1.0 before 0.12.1; hex: from 2.3.0 before 2.3.2; rebar3: from 3.9.1 before 3.27.0.

title: Erlang Rebar3 security vulnerability


summary: Incorrect Authorization vulnerability in hexpm hexpm/hexpm ('Elixir.HexpmWeb.API.OAuthController' module) allows Privilege Escalation. An API key created with read-only permissions (domain: "api", resource: "read") can be escalated to full write access under specific conditions. When exchanging a read-only API key via the OAuth client_credentials grant, the resource qualifier is ignored. The resulting JWT receives the broad "api" scope instead of the expected "api:read" scope. This token is therefore treated as having full API access. If an attacker is able to obtain a victim's read-only API key and a valid 2FA (TOTP) code for the victim account, they can use the incorrectly scoped JWT to create a new full-access API key with unrestricted API permissions that does not expire by default and can perform write operations such as publishing, retiring, or modifying packages. This vulnerability is associated with program files lib/hexpm_web/controllers/api/oauth_controller.ex and program routines 'Elixir.HexpmWeb.API.OAuthController':validate_scopes_against_key/2. This issue affects hexpm: from 71829cb6f6559bcceb1ef4e43a2fb8cdd3af654b before 71c127afebb7ed7cc637eb231b98feb802d62999.


summary: Insufficient Session Expiration vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Accounts.PasswordReset' module) allows Account Takeover. Password reset tokens generated via the "Reset your password" flow do not expire. When a user requests a password reset, Hex sends an email containing a reset link with a token. This token remains valid indefinitely until used. There is no time-based expiration enforced. If a user's historical emails are exposed through a data breach (e.g., a leaked mailbox archive), any unused password reset email contained in that dataset could be used by an attacker to reset the victim's password. The attacker does not need current access to the victim's email account, only access to a previously leaked copy of the reset email. This vulnerability is associated with program files lib/hexpm/accounts/password_reset.ex and program routines 'Elixir.Hexpm.Accounts.PasswordReset':can_reset?/3. This issue affects hexpm: from 617e44c71f1dd9043870205f371d375c5c4d886d before bb0e42091995945deef10556f58d046a52eb7884.


product: EasyDiscuss extension for Joomla

product: easydiscuss

vendor: stackideas

summary: Lack of input filterung leads to a persistent XSS vulnerability in the forum post handling of the Easy Discuss component for Joomla.


summary: Lack of input filterung leads to a persistent XSS vulnerability in the user avatar text handling of the Easy Discuss component for Joomla.


summary: User provided uploads to the Easy Discuss component for Joomla aren't properly validated. Uploads are purely checked by file extensions, no mime type checks are happening.


summary: Access control settings for forum post custom fields are not applied to the JSON output type, leading to an ACL violation vector an information disclosure

title: Stackideas Easydiscuss security vulnerability


product: Convert Forms

product: EngageBox

product: Google Structured Data

product: Advanced Custom Fields

product: Smile Pack

status: Deferred

summary: The vulnerability was rooted in how the Tassos Framework plugin handled specific AJAX requests through Joomla’s com_ajax entry point. Under certain conditions, internal framework functionality could be invoked without proper restriction.


product: Astroid Template Framework

vendor: templaza

summary: A improperly secured file management feature allows uploads of dangerous data types for unauthenticated users, leading to remote code execution.

title: Templaza Astroid Framework security vulnerability


product: Joomla! CMS

vendor: Joomla! Project

product: joomla!

vendor: joomla

summary: The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers.


summary: Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint.


summary: Lack of output escaping leads to a XSS vector in the multilingual associations component.


summary: Lack of output escaping for article titles leads to XSS vectors in various locations.


product: UniFi Protect Application

vendor: Ubiquiti Inc

vendor: ui

summary: A malicious actor with access to the adjacent network could obtain unauthorized access to a UniFi Protect Camera by exploiting a discovery protocol vulnerability in the Unifi Protect Application (Version 6.1.79 and earlier). Affected Products: UniFi Protect Application (Version 6.1.79 and earlier). Mitigation: Update your UniFi Protect Application to Version 6.2.72 or later.

title: Ui Unifi Protect security vulnerability


summary: A malicious actor with access to the adjacent network could overflow the UniFi Protect Application (Version 6.1.79 and earlier) discovery protocol causing it to restart. Affected Products: UniFi Protect Application (Version 6.1.79 and earlier). Mitigation: Update your UniFi Protect Application to Version 6.2.72 or later.

title: Ui Unifi Protect security vulnerability


product: UniFi Connect EV Station Lite

ecosystem: operating-system

summary: An Improper Access Control could allow a malicious actor in Wi-Fi range to the EV Station Lite (v1.5.2 and earlier) to use WiFi AutoLink feature on a device that was only adopted via Ethernet.

title: Ui Unifi Connect Ev Station Lite Firmware security vulnerability


product: node

vendor: nodejs

summary: A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without `--allow-net`, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution. * The issue affects users of the Node.js permission model on version v25. In the moment of this vulnerability, network permissions (`--allow-net`) are still in the experimental phase.

title: Nodejs Node.Js security vulnerability


summary: A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process termination or silent file descriptor leaks that eventually lead to denial of service. Because these callbacks process attacker-controlled input during the TLS handshake, a remote client can repeatedly trigger the issue. This vulnerability affects TLS servers using PSK or ALPN callbacks across Node.js versions where these callbacks throw without being safely wrapped.

title: Nodejs Node.Js security vulnerability


product: UBB-XG

product: UDB-Pro/UDB-Pro-Sector

product: UBB

summary: A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution (RCE) within the affected product. Affected Products: UBB-XG (Version 1.2.2 and earlier) UDB-Pro/UDB-Pro-Sector (Version 1.4.1 and earlier) UBB (Version 3.1.5 and earlier) Mitigation: Update your UBB-XG to Version 1.2.3 or later. Update your UDB-Pro/UDB-Pro-Sector to Version 1.4.2 or later. Update your UBB to Version 3.1.7 or later.

title: Ui Ubb-Xg Firmware security vulnerability


product: airMAX AC

product: airMAX M

product: airFiber AF60-XG

product: airFiber AF60

summary: A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution (RCE) within the affected product.

title: Ui Airmax Ac Firmware security vulnerability


product: Revive Adserver

vendor: Revive

vendor: aquaplatform

summary: HackerOne community member Jad Ghamloush (0xjad) has reported an authorization bypass vulnerability in the `tracker-delete.php` script of Revive Adserver. Users with permissions to delete trackers are mistakenly allowed to delete trackers owned by other accounts.

title: Aquaplatform Revive Adserver security vulnerability


summary: HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the `banner-acl.php` and `channel-acl.php` scripts of Revive Adserver. An attacker can craft a specific URL that includes an HTML payload in a parameter. If a logged in administrator visits the URL, the HTML is sent to the browser and malicious scripts would be executed.


product: FortiClientEMS

vendor: Fortinet

product: FortiClient EMS

vendor_project: Fortinet

vulnerability_name: Fortinet FortiClient EMS SQL Injection Vulnerability

author: Codex

content_markdown:
CVE-2026-21643 is a critical SQL-injection vulnerability in the FortiClient
EMS management server. Fortinet states that an unauthenticated attacker can
send specifically crafted HTTP requests to the administrative GUI and execute
unauthorized code or commands. The affected server release is exactly
FortiClient EMS `7.4.4`; Fortinet identifies `7.4.5` or later as the solution.

This finding is about the **EMS server version**, not the FortiClient agent
version installed on managed Windows, macOS, or Linux endpoints. Fortinet also
states in the advisory timeline that FortiEMS Cloud is not affected. Do not
classify an endpoint or the cloud service as vulnerable merely because its
name contains FortiClient.

## Evidence basis and limits

I reviewed Fortinet PSIRT advisory FG-IR-25-1142, Fortinet's FortiClient EMS
7.4.5 administration documentation, the current CISA KEV feed, the CVE record,
and the NVD record on 2026-07-22. I did not access an EMS deployment, inspect
private source, send a crafted request, or validate a customer environment.
The affected/fixed versions, attack path, severity, and KEV status below are
official source facts rather than observations from a live server.

The current Fortinet advisory and CVE record identify only `7.4.4` as affected.
Fortinet lists the 7.2 and 8.0 branches as not affected. Live NVD
exact-affects **7.4.4** only. Live GHAD `GHSA-r6vr-hwpr-qqch` has
**vulnerabilities empty**. Vendor names **7.4.5**. **7.4.5 is not an NVD
exclude.** NVD historically displayed a broader 7.4 range, but its change
history records the configuration being corrected to the exact `7.4.4`
release. Use the current Fortinet/CVE product status rather than the
superseded broad range. Do not invent a later 7.4.6 floor.

Official score displays have also differed, while all current sources classify
the issue as critical. This recipe does not depend on a particular numeric
score. Re-check FG-IR-25-1142 before approving a change because Fortinet can
revise product, exploitation, or upgrade guidance.

## Exploitation-status reconciliation

FG-IR-25-1142 currently contains two conflicting Fortinet signals: the
advisory narrative says exploitation has been observed in the wild, while its
sidebar still displays `Known Exploited: No`. CISA subsequently added
CVE-2026-21643 to the KEV catalog on 2026-04-13 and currently requires U.S.
federal civilian agencies subject to BOD 22-01 to apply vendor mitigations or
discontinue use when mitigations are unavailable.

For remediation priority, treat the CVE as **currently known exploited**. That
conclusion is based on the current CISA KEV entry and Fortinet's own narrative;
it does not erase the contradictory Fortinet sidebar or prove that a particular
EMS deployment was attacked. Preserve the source URLs and retrieval date in
review evidence instead of silently choosing one historical field. Never try
to resolve the discrepancy by probing a server.

## When to use this recipe

Use it when a scanner, asset inventory, ticket, repository, or operator
identifies a self-managed FortiClient EMS server that may run `7.4.4`. The
repository may own container/image references, VM definitions, installation or
upgrade automation, deployment manifests, database/HA runbooks, ingress or
network policy, inventory rules, monitoring checks, or vulnerability
exceptions.

Do not use it to test the SQL-injection path, send crafted HTTP traffic, change
a live EMS server without authority, or update managed endpoint agents as a
substitute for fixing the server. Repository authority is not authority over
the EMS application, database, HA cluster, ingress, or endpoint fleet.

## Inputs

- A redacted inventory of every EMS server and HA node: owner, environment,
  deployment model, server version/build, HA role, database topology, and
  evidence timestamp.
- Approved read-only version evidence from **Dashboard > Status > System
  Information**, which Fortinet documents as showing the EMS version, build,
  hostname, uptime, mode, and database controls.
- Product-boundary evidence distinguishing self-managed FortiClient EMS from
  FortiEMS Cloud and distinguishing the EMS server release from endpoint
  FortiClient agent releases.
- Administrative-GUI exposure evidence: listener/ingress configuration,
  interfaces, DNS/load-balancer path, approved source networks, authentication
  boundary, and effective reachability from untrusted networks.
- Repository-controlled images, packages, manifests, automation, HA/database
  definitions, ingress policy, runbooks, generated artifacts, and exceptions.
- The current Fortinet-supported target, upgrade compatibility, database
  backup and restore plan, HA sequence, endpoint compatibility, maintenance
  impact, ordinary health checks, and rollback owner.
- Approved security evidence for the exposure window: relevant server,
  administrative, application, database, identity, ingress, and centralized
  logs; existing alerts; incident owner; and Fortinet support status.

Do not commit credentials, certificates, license data, full database backups,
raw logs, diagnostic bundles, endpoint inventories, hostnames, network
topology, or customer data. Keep sensitive operational and forensic evidence
in its approved system.

## Affected and fixed versions

Fortinet publishes the following current matrix:

| FortiClient EMS branch | Status for CVE-2026-21643 | Required action |
| --- | --- | --- |
| 7.4 release `7.4.4` | Affected | Upgrade to `7.4.5` or later |
| 7.2 | Not affected according to FG-IR-25-1142 | No CVE-specific upgrade required |
| 8.0 | Not affected according to FG-IR-25-1142 | No CVE-specific upgrade required |
| FortiEMS Cloud | Not affected according to the advisory timeline | No CVE-specific customer upgrade |

Do not expand the affected set to every 7.4 release, and do not treat a managed
FortiClient endpoint running version `7.4.4` as proof that its EMS server is
affected. Conversely, endpoint-agent versions do not clear an EMS server that
runs `7.4.4`.

`7.4.5` is the first fixed threshold documented by Fortinet, not necessarily
the best long-term target on 2026-07-22. Select a currently supported Fortinet
release at or above that threshold, compatible with the EMS deployment model,
database, HA topology, integrations, and managed endpoint versions.

## How to determine exposure safely

Fortinet documents a read-only GUI path for the server version:

1. Through an approved authenticated session, open **Dashboard > Status**.
2. Read **System Information > Version**, including its build number and any
   interim-build label.
3. Record whether the System Information widget reports standalone or HA mode,
   then obtain equivalent evidence for every HA node.
4. Redact the hostname and other environment identifiers before attaching
   evidence to a code review.

If no live-session authority is granted, use an operator-provided screenshot,
signed asset inventory, installed-package report, or deployment evidence and
mark the live version unverified. A container tag, desired-state manifest, or
scanner result can locate ownership, but it is not proof of the running server.

Then establish reachability using approved configuration evidence:

- identify the administrative GUI listener and every ingress, proxy,
  load-balancer, VPN, and network policy in front of it;
- record which source networks can reach it and whether an untrusted network or
  compromised internal host could access that path; and
- determine the exposure window for every period in which `7.4.4` was running.

An EMS `7.4.4` server is affected even when its administrative GUI is private;
restricted reachability changes attack opportunity and containment priority,
not the vendor's affected-version status. Do not send a crafted request, SQL
fragment, malformed parameter, callback, or other active probe. Version and
configuration evidence are sufficient to require remediation.

## Incident-response gate

Resolve the incident question before routine upgrade work because the CVE is
currently in CISA KEV and Fortinet's narrative reports observed exploitation:

- If approved logs, alerts, or operator reports suggest attempted exploitation,
  unexpected administrative behavior, database activity, accounts,
  configuration changes, or command execution, stop the patch-only workflow.
- Preserve relevant evidence and notify the incident owner and Fortinet support
  before changing the server, database, ingress, credentials, or logs.
- Do not reboot, upgrade, restore, delete data, rotate credentials, or remove
  suspected artifacts until the incident owner decides what must be retained.
- Do not declare the server clean because one indicator or alert is absent.
- A fixed EMS version closes the vulnerable entry path; it does not establish
  recovery trust for a server that may already have been compromised.

This is conservative incident handling based on known exploitation. The public
Fortinet advisory does not provide a complete forensic checklist for every EMS
deployment model.

## Temporary containment

FG-IR-25-1142 does not publish a product-specific workaround. Do not invent
one or describe a WAF rule, request filter, endpoint-agent update, or version
string check as vendor mitigation.

When an immediate upgrade is impossible, the responsible network and service
owners may consider time-bounded isolation or strict source restriction of the
administrative GUI as defense in depth. Label that as a local containment
decision, not a Fortinet workaround or remediation. Record the approving
owner, affected administration workflows, alternate access path, effective
policy, validation, expiry, and restoration plan. If safe containment cannot be
proved, stop with `TRIAGE.md` and escalate the upgrade or discontinuation
decision required by the current CISA KEV action.

## How to remediate CVE-2026-21643

1. Inventory every standalone or HA EMS server, deployment artifact, database,
   and reinstall/recovery path. Exclude FortiEMS Cloud and endpoint agents from
   the server-upgrade matrix, but preserve endpoint compatibility evidence.
2. Resolve the incident-response gate before changing an exposed `7.4.4`
   server. Suspected compromise requires evidence preservation and an incident
   owner, not a patch-only conclusion.
3. Select a currently supported FortiClient EMS release at or above `7.4.5`.
   Fortinet documents direct `7.4.5` upgrade support from EMS `7.4.3` and
   `7.4.4`; validate the current vendor path for any newer target.
4. Verify EMS-to-FortiClient compatibility. Fortinet documents that EMS 7.4.5
   supports FortiClient 7.4 and 7.2, so endpoint compatibility is a rollout
   prerequisite even though endpoint versions do not cause this CVE.
5. Back up the EMS database through the approved Fortinet procedure and
   recovery owner. Keep the backup and its password outside Git. When incident
   response is active, let the incident owner decide backup and preservation
   order.
6. Update every repository-controlled image/package reference, VM/container or
   Kubernetes definition, automation, HA/database runbook, ingress policy,
   inventory rule, monitor, generated artifact, and recovery definition that
   could reinstall `7.4.4`.
7. For HA, document the human-reviewed node sequence and database implications.
   Fortinet recommends manual node upgrades rather than automatic upgrade for
   HA clusters.
8. Keep live upgrade, database, HA, ingress, credential, and endpoint-fleet
   actions with the authorized operator unless the task explicitly grants that
   exact production authority.

## How to verify remediation

- Re-open **Dashboard > Status > System Information** and confirm that every
  running EMS node reports `7.4.5` or a later approved release, including the
  expected build and HA mode.
- Verify the running server, not merely a downloaded installer, image tag,
  desired-state manifest, or scheduled upgrade.
- Confirm repository-controlled images, manifests, automation, HA/recovery
  definitions, and generated artifacts no longer resolve to `7.4.4`.
- Run existing non-adversarial checks for EMS login, Dashboard status,
  database health, license state, endpoint connectivity/telemetry,
  integrations, monitoring, and HA health. Do not exercise the SQL-injection
  path.
- Confirm any local administrative-GUI containment remains tracked with an
  owner and expiry or was removed through the approved restoration plan after
  fixed-version evidence was collected.
- Record target, HA role, before/after version and build, evidence time,
  verifier, database/HA result, ordinary health checks, and unresolved
  incident actions.

Do not suppress the finding until every controlled EMS node and reinstall path
has fixed-version evidence. Do not call the environment uncompromised based on
a successful upgrade or normal endpoint telemetry.

## Rollback and stop conditions

Prefer forward recovery to another supported fixed release. If an operational
regression requires restoring the Fortinet-documented EMS database backup or a
prior server artifact, confirm that the application version and database are
compatible. A rollback to `7.4.4` restores vulnerable software: isolate the
administrative GUI through the approved local containment, retain an incident
and upgrade owner, and set a time-bounded return to fixed software.

Stop and write `TRIAGE.md` when:

- the product boundary, running EMS version/build, HA membership, database
  topology, or administrative-GUI reachability cannot be proved;
- evidence refers only to managed endpoint agents or FortiEMS Cloud rather
  than the self-managed EMS server;
- the repository does not own the deployment, image, upgrade automation,
  ingress, or runbook needed for remediation;
- suspected exploitation creates an evidence-preservation or incident-response
  decision;
- the target release, upgrade path, endpoint compatibility, database backup,
  HA sequence, maintenance window, ordinary health checks, or rollback cannot
  be validated safely;
- containment or remediation requires live EMS, database, ingress, HA,
  credential, or endpoint-fleet authority not granted by the task; or
- meaningful verification would require crafted HTTP traffic, SQL injection,
  active probing, sensitive-data access, or a destructive test.

`TRIAGE.md` must name CVE-2026-21643, files and evidence inspected, redacted EMS
target and owner, deployment model, observed and required server version, HA
and database state, GUI reachability, exploitation-status source discrepancy,
containment, compromise concern, authority or compatibility blocker, next
responsible human, and safest next action.

## The prompt

~~~markdown
You are remediating CVE-2026-21643, a critical, currently KEV-listed SQL-
injection vulnerability in the FortiClient EMS administrative GUI.

Return exactly one output:

- a reviewer-ready change set that updates every repository-controlled,
  self-managed FortiClient EMS 7.4.4 server to a supported release at or above
  7.4.5 and documents safe verification, incident handling, and rollback; or
- `TRIAGE.md` when ownership, live state, evidence preservation, upgrade
  safety, authority, or verification cannot be resolved here.

### Guardrails

- Scope only CVE-2026-21643 and directly related EMS server inventory,
  version/image targets, administrative-GUI exposure, database/HA upgrade
  artifacts, safe verification, containment, and incident handoff.
- Do not confuse the EMS server with managed FortiClient endpoint agents.
  FortiEMS Cloud is not affected according to Fortinet's advisory timeline.
- Do not connect to, scan, probe, or mutate a live EMS deployment unless the
  task explicitly grants that exact authority.
- Do not generate, copy, or send a crafted HTTP request, SQL fragment,
  malformed parameter, callback, file, or proof-of-concept.
- Do not treat a scanner string, endpoint-agent version, container tag,
  desired-state file, or scheduled upgrade as proof of the running EMS version.
- Treat this CVE as currently known exploited: Fortinet's narrative reports
  observed exploitation and CISA added it to KEV on 2026-04-13, despite the
  Fortinet sidebar still displaying `Known Exploited: No`.
- Do not store credentials, certificates, license data, database backups, raw
  logs, diagnostic bundles, endpoint inventories, hostnames, topology, or
  customer data in Git.
- Do not upgrade, reboot, restore, fail over, modify ingress, rotate
  credentials, or remove suspected artifacts automatically.
- Do not describe a fixed server as proof that prior compromise did not occur.

### Steps

1. Inventory repository-owned EMS images/packages, VM/container/Kubernetes
   definitions, automation, HA/database topology, ingress, runbooks, monitors,
   generated artifacts, recovery definitions, and vulnerability exceptions.
2. Build a redacted target matrix containing owner, deployment model, running
   EMS version/build and evidence date, HA role, database, administrative-GUI
   reachability, desired fixed release, endpoint compatibility, and repository
   control point. Separate EMS server data from endpoint-agent data.
3. Classify using the current Fortinet matrix:
   - EMS 7.4.4: affected; upgrade to 7.4.5 or later.
   - EMS 7.2 and 8.0: not affected.
   - FortiEMS Cloud: not affected according to the advisory timeline.
   Do not expand the affected range based on superseded NVD data.
4. Resolve the incident-response gate from approved, already-available
   evidence. If suspicious activity exists, stop routine patching, preserve
   evidence, and name the incident owner and Fortinet support handoff.
5. Select a currently supported EMS release at or above 7.4.5 and validate
   upgrade, endpoint compatibility, database backup/restore, HA sequence,
   maintenance, normal health checks, and rollback.
6. Update all repository-controlled images, definitions, automation, ingress
   policy, inventory rules, runbooks, monitors, generated artifacts, and
   recovery paths that could reinstall or expose 7.4.4.
7. If upgrade cannot be immediate, document only human-approved local
   administrative-GUI isolation/source restriction as defense in depth.
   Fortinet publishes no product-specific workaround in FG-IR-25-1142.
8. Add static policy tests that fail when a controlled EMS server, HA node,
   generated artifact, or recovery path remains at 7.4.4, or when an exception
   lacks owner, expiry, evidence, and fixed target.
9. Run only repository schema, formatting, rendering, and policy checks plus
   existing ordinary EMS health checks. Never exercise the SQL-injection path.
10. Document operator-only actions: database backup, upgrade/HA sequence,
    maintenance impact, Dashboard version verification, normal health checks,
    containment removal, and rollback.

### Stop conditions

Stop with `TRIAGE.md` if the server boundary or running version is unknown;
compromise is possible; the target, compatibility, backup, HA plan, or rollback
is unvalidated; live changes exceed authority; or verification would require
crafted traffic, exploit behavior, sensitive evidence, or a destructive test.

The output must distinguish repository evidence, operator-supplied evidence,
and unverified live state. It must preserve the Fortinet/CISA status
discrepancy and must not claim a server was patched, protected, or clean
without authorized execution evidence.
~~~

## Output contract

Return one of:

- A reviewer-ready PR/change request that inventories every controlled EMS
  server, updates all image/package/deployment/HA/recovery references to an
  approved release at or above `7.4.5`, supplies safe tests, and records
  human-owned database backup, upgrade, verification, incident, and rollback
  actions.
- `TRIAGE.md` containing bounded evidence, owner, deployment model, observed and
  required EMS server version, HA/database state, GUI reachability, exploitation
  status and source dates, containment, compromise concern, authority or
  compatibility blocker, and next action.

The output must say what was verified from repository artifacts, what came
from an operator, and what remains unverified. It must not contain exploit
material or claim that a live EMS deployment is fixed or trustworthy without
approved execution evidence.

## Primary references

- [Fortinet PSIRT advisory FG-IR-25-1142](https://fortiguard.fortinet.com/psirt/FG-IR-25-1142)
- [GitHub Advisory GHSA-r6vr-hwpr-qqch](https://github.com/advisories/GHSA-r6vr-hwpr-qqch)
- [Fortinet EMS 7.4.5 System Information widget](https://docs.fortinet.com/document/forticlient/7.4.5/ems-administration-guide/023537/system-information-widget)
- [Fortinet EMS 7.4.5 upgrade guidance](https://docs.fortinet.com/document/forticlient/7.4.5/ems-administration-guide/800746/upgrading-ems)
- [Fortinet automatic-upgrade, backup, and HA guidance](https://docs.fortinet.com/document/forticlient/7.4.5/ems-administration-guide/371397)
- [CISA Known Exploited Vulnerabilities catalog entry](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21643)
- [CISA KEV JSON feed](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [CVE Program record for CVE-2026-21643](https://www.cve.org/CVERecord?id=CVE-2026-21643)
- [NVD record for CVE-2026-21643](https://nvd.nist.gov/vuln/detail/CVE-2026-21643)

## Related recipes

- [CVE intelligence intake gate]({{< relref "/recipes/general/cve-intelligence-intake-gate" >}})
- [CVE-2025-25257 FortiWeb SQL injection]({{< relref "/recipes/cve/cve-2025-25257-fortiweb-sql-injection" >}})
- [How to remediate vulnerabilities with AI agents]({{< relref "/security-remediation" >}})

description: Remediate CVE-2026-21643 FortiClient EMS SQLi. GHAD vulnerabilities empty. NVD exact-affects 7.4.4. Vendor names 7.4.5.

maturity: stable

title: CVE-2026-21643: FortiClient EMS SQL injection

product: forticlientems

vendor: fortinet

quality: curated

recipe_kind: markdown-override

summary: An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.


vendor: Johnson Controls

status: Awaiting Analysis

summary: Victor SSRF vulnerability in Johnson Controls CCure 9000 and victor application server allows Server Side Request Forgery. This issue affects CCure 9000 and victor application server: from 2.9 through 3.0.


product: Frick Controls Quantum HD

vendor: johnsoncontrols

summary: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows OS Command Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the security of the device before authentication occurs.This issue affects Frick Controls Quantum HD version 10.22 and prior.

title: Johnsoncontrols Frick Controls Quantum Hd Firmware security vulnerability


product: victor

vendor: Johnson Control

product: CCure 9000

product: Victor Application Server

summary: Deserialization of untrusted data vulnerability in Johnson Control victor on Windows, Johnson Controls CCure 9000, and Johnson Controls Victor Application Server allows capec-586. This issue affects victor: before 8.0; CCure 9000: before 3.2; Victor Application Server: before 4.1.

title: Johnson Control Victor security vulnerability


summary: Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the security of the device before authentication occurs.This issue affects Frick Controls Quantum HD version 10.22 and prior.


version: Frick Controls Quantum HD version 10.22 and prior

title: Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection


summary: Unauthenticated Remote Code Execution i.e Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the security of the device before authentication occurs.This issue affects Frick Controls Quantum HD version 10.22 and prior.


summary: Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion (LFI) vulnerability in Johnson Controls Frick Controls Quantum HD allow an unauthenticated attacker to execute arbitrary code on the affected device, leading to full system compromise. This issue affects Frick Controls Quantum HD: Frick Controls Quantum HD version 10.22 and prior.


summary: Hardcoded Email Credentials Saved as Plaintext in Firmware (CWE-256: Plaintext Storage of a Password) vulnerability in Frick Controls Quantum HD version 10.22 and prior lead to unauthorized access, exposure of sensitive information, and potential misuse or system compromise This issue affects Frick Controls Quantum HD version 10.22 and prior.


vendor: JohnsonControls

less_than: release 10

less_than: release 9

less_than: release 3

version_end_excluding: release 10

summary: Uncontrolled Search Path Element vulnerability in JohnsonControls AC2000 on Windows allows Leveraging/Manipulating Configuration File Search Paths. This issue affects AC2000: from 10.6 before release 10, from 11.0 before release 9, from 12 before release 3.

title: Johnsoncontrols Ac2000 security vulnerability


product: FM Systems Employee

summary: Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malicious Files. This issue affects FM Systems Employee: before 2025.3.1.


summary: HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the banner-acl.php script of Revive Adserver. An attacker can craft a specific URL that includes an HTML payload in a parameter. If a logged in administrator visits the URL, the HTML is sent to the browser and malicious scripts would be executed.


summary: HackerOne community member Huynh Pham Thanh Luc (nigh7c0r3) has reported a reflected XSS vulnerability in the afr.php delivery script of Revive Adserver. An attacker can craft a specific URL that includes an HTML payload in a parameter. If a logged in administrator visits the URL, the HTML is sent to the browser and malicious scripts would be executed.


product: Originate Loans Peripherals (formerly Velocity Services) -- Print Service component

vendor: Fiserv

summary: The Print Service component of Fiserv Originate Loans Peripherals (formerly Velocity Services) in unsupported version 2021.2.4 (build 4.7.3155.0011) uses deprecated .NET Remoting TCP channels that allow unsafe deserialization of untrusted data. When these services are exposed to an untrusted network in a client-managed deployment, an unauthenticated attacker can achieve remote code execution. Version 2021.2.4 is no longer supported by Fiserv. Customers should upgrade to a currently supported release (2025.1 or later) and ensure that .NET Remoting service ports are not exposed beyond trusted network boundaries. This CVE documents behavior observed in a client-hosted deployment running an unsupported legacy version of Originate Loans Peripherals with .NET Remoting ports exposed to an untrusted network. This is not a default or supported configuration. Customers running legacy versions should upgrade to a currently supported release and ensure .NET Remoting ports are restricted to trusted network segments. The finding does not apply to Fiserv-hosted environments.

title: Fiserv Originate Loans Peripherals (Formerly Velocity Services) -- Prin… security vulnerability


product: Backup and Replication

vendor: Veeam

vendor: veeam

summary: A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.


default_status: affected

title: A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server


summary: A vulnerability allowing an authenticated domain user to bypass restrictions and manipulate arbitrary files on a Backup Repository.


summary: A vulnerability allowing a low-privileged user to extract saved SSH credentials.


product: Software Appliance

summary: A vulnerability allowing an authenticated user with the Backup Administrator role to perform remote code execution (RCE) in high availability (HA) deployments of Veeam Backup & Replication.

title: Veeam Veeam Backup & Replication security vulnerability


summary: A vulnerability allowing local privilege escalation on Windows-based Veeam Backup & Replication servers.


product: iccDEV

vendor: InternationalColorConsortium

product: iccdev

vendor: color

summary: iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below have overflows and underflows in CIccXmlArrayType::ParseTextCountNum(). This vulnerability affects users of the iccDEV library who process ICC color profiles. This issue is fixed in version 2.3.1.1.


summary: iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below contain a memory leak vulnerability in its XML MPE Parsing Path (iccFromXml). This issue is fixed in version 2.3.1.1.


summary: iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below contain a Use After Free vulnerability in the CIccXform::Create() function, where it deletes the hint. This issue is fixed in version 2.3.1.1.


summary: iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below have a Heap-based Buffer Overflow in its CIccMBB::Validate function which checks tag data validity. This issue is fixed in version 2.3.1.1.


summary: iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below have Undefined Behavior in its CIccCLUT::Init function which initializes and sets the size of a CLUT. This issue is fixed in version 2.3.1.1.


summary: iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vulnerable to heap-buffer-overflow vulnerability in IccTagXml(). This issue has been patched in version 2.3.1.2.


summary: iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vulnerable to heap-buffer-overflow in CIccLocalizedUnicode::GetText(). This issue has been patched in version 2.3.1.2.


summary: iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a NULL pointer dereference vulnerability. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.

title: Color Iccdev security vulnerability


summary: iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Undefined Behavior runtime error. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.

title: Color Iccdev security vulnerability


summary: iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a heap-buffer-overflow in `CIccXmlArrayType::ParseText()`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.

title: Color Iccdev security vulnerability


summary: iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `icStatusCMM::CIccEvalCompare::EvaluateProfile()`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.

title: Color Iccdev security vulnerability


summary: iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have Undefined Behavior in `CIccTagSpectralViewingConditions()`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.

title: Color Iccdev security vulnerability


summary: iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have Undefined Behavior in `CIccTagLut16::Read()`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.

title: Color Iccdev security vulnerability


summary: iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have Undefined Behavior in `CIccTagLutAtoB::Validate()`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.

title: Color Iccdev security vulnerability


summary: iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have Undefined Behavior in `CIccTagCurve::CIccTagCurve()`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.

title: Color Iccdev security vulnerability


summary: iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `SIccCalcOp::ArgsPushed()` at `IccProfLib/IccMpeCalc.cpp`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.

title: Color Iccdev security vulnerability


summary: iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `CIccProfileXml::ParseBasic()` at `IccXML/IccLibXML/IccProfileXml.cpp`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.

title: Color Iccdev security vulnerability


summary: iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `CIccTagXmlTagData::ToXml()`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.

title: Color Iccdev security vulnerability


summary: iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `CIccTag:IsTypeCompressed()`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.

title: Color Iccdev security vulnerability


summary: iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `ToXmlCurve()` at `IccXML/IccLibXML/IccMpeXml.cpp`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.

title: Color Iccdev security vulnerability


summary: iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `CIccSegmentedCurveXml::ToXml()` at `IccXML/IccLibXML/IccMpeXml.cpp`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.

title: Color Iccdev security vulnerability


product: titra

vendor: kromitgmbh

vendor: kromit

summary: Titra is open source project time tracking software. Versions 0.99.49 and below have Improper Access Control, allowing users to view and edit other users' time entries in private projects they have not been granted access to. This issue is fixed in version 0.99.50.


summary: Titra is open source project time tracking software. In versions 0.99.49 and below, an API has a Mass Assignment vulnerability which allows authenticated users to inject arbitrary fields into time entries, bypassing business logic controls via the customfields parameter. The affected endpoint uses the JavaScript spread operator (...customfields) to merge user-controlled input directly into the database document. While customfields is validated as an Object type, there is no validation of which keys are permitted inside that object. This allows attackers to overwrite protected fields such as userId, hours, and state. The issue is fixed in version 0.99.50.


product: wings

vendor: pterodactyl

summary: Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Starting in version 1.7.0 and prior to version 1.12.0, Wings does not consider SQLite max parameter limit when processing activity log entries allowing for low privileged user to trigger a condition that floods the panel with activity records. After Wings sends activity logs to the panel it deletes the processed activity entries from the wings SQLite database. However, it does not consider the max parameter limit of SQLite, 32766 as of SQLite 3.32.0. If wings attempts to delete more than 32766 entries from the SQLite database in one query, it triggers an error (SQL logic error: too many SQL variables (1)) and does not remove any entries from the database. These entries are then indefinitely re-processed and resent to the panel each time the cron runs. By successfully exploiting this vulnerability, an attacker can trigger a situation where wings will keep uploading the same activity data to the panel repeatedly (growing each time to include new activity) until the panels' database server runs out of disk space. Version 1.12.0 fixes the issue.


vendor: rezmoss

summary: axios4go is a Go HTTP client library. Prior to version 0.6.4, a race condition vulnerability exists in the shared HTTP client configuration. The global `defaultClient` is mutated during request execution without synchronization, directly modifying the shared `http.Client`'s `Transport`, `Timeout`, and `CheckRedirect` properties. Impacted applications include that that use axios4go with concurrent requests (multiple goroutines, `GetAsync`, `PostAsync`, etc.), those where different requests use different proxy configurations, and those that handle sensitive data (authentication credentials, tokens, API keys). Version 0.6.4 fixes this issue.

title: axios4go is a Go HTTP client library


summary: A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user.


summary: A vulnerability allowing a local attacker with administrator privileges to bypass Windows Driver Signature Enforcement.


product: node

vendor: nodejs

product: Red Hat Enterprise Linux 10

vendor: Red Hat

version_type: rpm

product: Red Hat Enterprise Linux 10.0 Extended Update Support

product: Red Hat Enterprise Linux 8

product: Red Hat Enterprise Linux 9

product: Red Hat Enterprise Linux 9.4 Extended Update Support

product: Red Hat Enterprise Linux 9.6 Extended Update Support

description: CVE-2026-21710 throws an uncaught TypeError when req.headersDistinct meets a __proto__ header. GHSA last-names 20.x, 22.x, 24.x, and v25.x. Do not invent a point release.

maturity: development

model: GPT 5.5 Extra High reasoning

title: CVE-2026-21710: Node.js headersDistinct __proto__ Crash, 20-25

summary: A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`. * This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**

title: Nodejs Node.Js security vulnerability


summary: A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them. As a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary. This vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an experimental feature.

title: Nodejs Node.Js security vulnerability


summary: A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malformed internationalized domain name (IDN) containing invalid characters, crashing the Node.js process.

title: Nodejs Node.Js security vulnerability


summary: A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytes. Under certain threat models where high-resolution timing measurements are possible, this behavior could be exploited as a timing oracle to infer HMAC values. Node.js already provides timing-safe comparison primitives used elsewhere in the codebase, indicating this is an oversight rather than an intentional design decision. This vulnerability affects **20.x, 22.x, 24.x, and 25.x**.

title: Nodejs Node.Js security vulnerability


summary: A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up. This vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25.

title: Nodejs Node.Js security vulnerability


summary: A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process. The most common trigger is any endpoint that calls `JSON.parse()` on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table. This vulnerability affects **20.x, 22.x, 24.x, and 25.x**.

title: Nodejs Node.Js security vulnerability


product: Copeland XWEB 300D PRO

vendor: Copeland

product: Copeland XWEB 500D PRO

product: Copeland XWEB 500B PRO

vendor: copeland

summary: An authentication bypass vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, enabling any attackers to bypass the authentication requirement and achieve pre-authenticated code execution on the system.

title: Copeland Xweb 300D Pro Firmware security vulnerability


product: CubeCart

vendor: CubeCart Limited

version: prior to 6.6.0

product: cubecart

vendor: cubecart

summary: An OS command injection vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with an administrative privilege to execute an arbitrary OS command.

title: Cubecart security vulnerability


product: grafana/grafana-enterprise

vendor: Grafana

product: grafana/grafana

description: CVE-2026-21720 spawns a goroutine for every uncached /avatar/:hash request. GHSA names no version range and no floor.

title: CVE-2026-21720: Dashboard Avatar Refresh, No Named Floor

product: grafana

vendor: grafana

recipe_kind: markdown-draft

summary: Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an unbuffered channel. Sustained traffic with random hashes keeps tripping this timeout, so goroutine count grows linearly, eventually exhausting memory and causing Grafana to crash on some systems.