Executive assessment
Today's brief leads with Multiple vulnerabilities in vm2. All 8 selected findings retain their own technical scope, action, observed status, and evidence limits.
Finding 01 — Multiple vulnerabilities in vm2
What changed: An attacker can exploit multiple vulnerabilities in vm2 to cause a denial of service, execute arbitrary code, disclose information or manipulate data. CVE coverage: CVE-2026-47683, CVE-2026-47686, CVE-2026-47698.
Technical evidence: CVE-2026-47686; CVSS v3.1 9.9; weakness ['CWE-693']; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2026-47686 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: exploitation status unknown
fixed version or patch state unknown
affected product not structured
[Evidence source: wid.cert-bund.de](<https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2865>)
Finding 02 — Multiple vulnerabilities in WP Royal Royal Elementor Addons
What changed: A remote authenticated attacker can exploit multiple vulnerabilities in WP Royal Royal Elementor Addons to carry out server-side request forgery and cross-site scripting attacks. CVE coverage: CVE-2026-17123, CVE-2026-19217.
Technical evidence: CVE-2026-17123; CVSS v3.1 8.8; weakness ['CWE-918']; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2026-17123 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: exploitation status unknown
fixed version or patch state unknown
affected product not structured
[Evidence source: wid.cert-bund.de](<https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2859>)
Finding 03 — Vulnerability in Budibase
What changed: A remote authenticated attacker can exploit a vulnerability in Budibase to manipulate files. CVE coverage: CVE-2026-72859.
Technical evidence: CVE-2026-72859; CVSS v4.0 8.3; weakness ['CWE-863']; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2026-72859 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: exploitation status unknown
fixed version or patch state unknown
affected product not structured
[Evidence source: wid.cert-bund.de](<https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2861>)
Finding 04 — Lemur: Incomplete fix for GHSA-v2wp-frmc-5q3v -- ACME authority update endpoint allows non-admin to replace 'acme_url' with internal IP, bypassing allowlist.
What changed: Lemur: Incomplete fix for GHSA-v2wp-frmc-5q3v -- ACME authority update endpoint allows non-admin to replace acme_url with internal IP, bypassing allowlist. CVE coverage: CVE-2026-71303.
Technical evidence: CVE-2026-71303; CVSS v3.1 7.7; weakness ['CWE-918']; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2026-71303 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: exploitation status unknown
fixed version or patch state unknown
affected product not structured
[Evidence source: github.com](<https://github.com/advisories/GHSA-v5rc-cpwc-cfpr>)
Finding 05 — Vulnerability in PostgreSQL
What changed: A remote anonymous attacker can exploit a vulnerability in PostgreSQL to cause a denial of service. CVE coverage: CVE-2025-4207.
Technical evidence: CVE-2025-4207; CVSS v3.1 5.9; weakness ['CWE-126']; technical confidence High.
Why it matters: The Medium priority requires exposure validation and scheduled remediation through normal change control.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2025-4207 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: exploitation status unknown
fixed version or patch state unknown
[Evidence source: wid.cert-bund.de](<https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-0986>)
Finding 06 — Vulnerability in Red Hat Undertow
What changed: A remote anonymous attacker can exploit a vulnerability in Red Hat Undertow to manipulate files. CVE coverage: CVE-2026-19879.
Technical evidence: CVE-2026-19879; CVSS v3.1 5.3; weakness ['CWE-681']; technical confidence High.
Why it matters: The Medium priority requires exposure validation and scheduled remediation through normal change control.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2026-19879 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: exploitation status unknown
fixed version or patch state unknown
affected product not structured
[Evidence source: wid.cert-bund.de](<https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2862>)
Finding 07 — Vulnerability in NGINX
What changed: A remote authenticated attacker can exploit a vulnerability in NGINX NGINX Plus and NGINX to bypass security controls. CVE coverage: CVE-2025-23419.
Technical evidence: CVE-2025-23419; CVSS v3.1 4.3; weakness ['CWE-863']; technical confidence High.
Why it matters: The Medium priority requires exposure validation and scheduled remediation through normal change control.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2025-23419 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: exploitation status unknown
fixed version or patch state unknown
affected product not structured
[Evidence source: wid.cert-bund.de](<https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-0274>)
Finding 08 — Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for GHSA-54vg-pfh7-jq95).
What changed: Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for GHSA-54vg-pfh7-jq95). CVE coverage: CVE-2026-70667.
Technical evidence: CVE-2026-70667; CVSS v3.1 6.3; weakness ['CWE-367', 'CWE-918']; technical confidence High.
Why it matters: The Medium priority requires exposure validation and scheduled remediation through normal change control.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2026-70667 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: exploitation status unknown
fixed version or patch state unknown
affected product not structured
[Evidence source: github.com](<https://github.com/advisories/GHSA-f3qq-49m6-rw8f>)