Executive assessment
Today's brief leads with Flowise 3.1.2 and earlier: five sandbox escape and code-execution vulnerabilities. All 15 selected findings retain their own technical scope, action, observed status, and evidence limits.
Panel synthesis: Finding 01 leads because it is the only critical finding, combines five sandbox-escape and code-execution vulnerabilities, has proof-of-concept exploitation, and has patched Flowise and flowise-components releases available. Themes: PoC-backed code execution and sandbox escape; Denial-of-service exposure in networked services; Unsafe parsing, formula, and clone-option handling. Patch order: Finding 01 (It is the sole critical finding, has proof-of-concept exploitation, covers five sandbox-escape and code-execution vulnerabilities, and is patched in Flowise 3.1.3 and flowise-components 3.1.3); Finding 06 (It is high severity with proof-of-concept exploitation and IBM has published specific AIX and VIOS remediation levels); Finding 10 (It is high severity with proof-of-concept exploitation in OpenPanel chart formula validation and is fixed in 2.3.0); Finding 04 (It is high severity with proof-of-concept exploitation in GitPython clone option handling and is fixed in GitPython 3.1.54 or later); Finding 03 (It is high severity with proof-of-concept exploitation in toml-node parsing issues and the listing provides fixed toml versions 4.1.2 and 4.2.0).
Also today: 9 Linux kernel fixes (CVE-2026-64348, CVE-2026-64352, CVE-2026-64362, CVE-2026-64363, CVE-2026-64365, CVE-2026-64407, CVE-2026-64421, CVE-2026-64424, CVE-2026-64433), highest CVSS 7.8, none reported exploited; carried as a note rather than a finding.
Finding 01 — Flowise 3.1.2 and earlier: five sandbox escape and code-execution vulnerabilities
What changed: Flowise before 3.1.3 contains five related flaws across custom functions, Python validation, Airtable and CSV agents, and the Custom MCP node. Depending on configuration and node exposure, authenticated or unauthenticated attackers can escape sandboxes, exfiltrate data, write files, or execute commands as the Flowise process.
Technical evidence: CVE-2026-73483; CVSS v4.0 9.4; weakness CWE-78; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: For versions 3.0.8 to 3.1.2, keep ALLOW_BUILTIN_DEP unset or false to hide the broad dependency allowlist from custom-function code. Set CUSTOM_MCP_PROTOCOL=sse rather than stdio to close the reported Custom MCP RCE path. ([github.com](https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-9gvv-qjj3-2p6g), [github.com](https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-g98q-rm45-q9h8), [api.github.com](https://api.github.com/repos/FlowiseAI/Flowise/security-advisories/GHSA-9gvv-qjj3-2p6g))
Affected: The npm packages flowise and flowise-components through 3.1.2 are affected. ([api.github.com](https://api.github.com/repos/FlowiseAI/Flowise/security-advisories/GHSA-9gvv-qjj3-2p6g))
Fix: Flowise 3.1.3 and flowise-components 3.1.3 are patched. ([api.github.com](https://api.github.com/repos/FlowiseAI/Flowise/security-advisories/GHSA-9gvv-qjj3-2p6g))
Action: Map CVE-2026-73483 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-73483)
Finding 02 — Multiple vulnerabilities in Phoenix
What changed: CVE coverage: CVE-2026-56812, CVE-2026-56811. The cited advisories disclose: Presence keys colliding with Object.prototype members break existence; Unbounded channel joins per transport enables DoS over few connections.
Technical evidence: CVE-2026-56811; CVSS v4.0 8.7; weakness CWE-770; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Analyst note: For CVE-2026-56811, limit the number and rate of channel-join frames per connection at the reverse proxy, or disable unneeded transports. For CVE-2026-56812, reject or sanitise presence keys that collide with JavaScript Object.prototype member names. ([cna.erlef.org](https://cna.erlef.org/cves/CVE-2026-56811.html), [cna.erlef.org](https://cna.erlef.org/cves/CVE-2026-56812.html), [github.com](https://github.com/advisories/GHSA-63mc-hw7g-86rr), +1 more)
Affected: CVE-2026-56811: Phoenix 0.11.0 to before 1.5.15, 1.6.0-rc.0 to before 1.6.17, 1.7.0-rc.0 to before 1.7.24, and 1.8.0-rc.0 to before 1.8.9. CVE-2026-56812: Phoenix 1.2.0-rc.0 to before 1.5.15, 1.6.0-rc ([cna.erlef.org](https://cna.erlef.org/cves/CVE-2026-56811.html), [cna.erlef.org](https://cna.erlef.org/cves/CVE-2026-56812.html))
Fix: Both CVEs are patched in Phoenix 1.5.15, 1.6.17, 1.7.24 and 1.8.9. ([github.com](https://github.com/phoenixframework/phoenix/security/advisories/GHSA-6983-jfq8-485w), [github.com](https://github.com/advisories/GHSA-63mc-hw7g-86rr))
Action: Map CVE-2026-56811 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: github.com](https://github.com/advisories/GHSA-63mc-hw7g-86rr)
Finding 03 — toml-node: Prototype Pollution Leads to Object.prototype Corruption via `__pro
What changed: CVE coverage: CVE-2026-63376, CVE-2026-77465. toml-node can desynchronize key paths involving proto, leading to prototype pollution and corruption of Object.prototype.
Technical evidence: CVE-2026-63376; CVSS v3.1 8.2; weakness CWE-1321; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: CVE-2026-63376: prevent untrusted TOML input from reaching toml.parse() until upgraded. CVE-2026-77465: bound untrusted input length and bracket-nesting depth before toml.parse(), rejecting maximum [/{ nesting above a few hundred. ([github.com](https://github.com/advisories/GHSA-v5mp-jgw5-2x6j), [github.com](https://github.com/advisories/GHSA-82x6-q7mm-w9cf), [securelayer7.net](https://securelayer7.net/lab/cve-2026-63376-toml-node-prototype-pollution-proto-desync), +1 more)
Affected: CVE-2026-63376: toml versions before 4.1.2; CVE-2026-77465: toml versions before 4.2.0. ([github.com](https://github.com/advisories/GHSA-v5mp-jgw5-2x6j), [github.com](https://github.com/advisories/GHSA-82x6-q7mm-w9cf))
Fix: CVE-2026-63376: toml 4.1.2; CVE-2026-77465: toml 4.2.0. ([github.com](https://github.com/advisories/GHSA-v5mp-jgw5-2x6j), [github.com](https://github.com/advisories/GHSA-82x6-q7mm-w9cf))
Action: Map CVE-2026-63376 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: github.com](https://github.com/advisories/GHSA-v5mp-jgw5-2x6j)
Finding 04 — GitPython: OS Command Injection
What changed: GitPython before 3.1.54 contains an incomplete denylist in unsafe_git_clone_options that omits --template, allowing attackers to achieve arbitrary command execution during clone operations. Attackers can supply --template pointing to a directory containing malicious post-checkout hooks that execute when git clones the repository.
Technical evidence: CVE-2026-73623; CVSS v4.0 7.7; weakness CWE-78; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Block --template from all GitPython clone options and prevent untrusted callers from influencing those options. Restrict clone processes from reading attacker-writable directories that could contain executable hooks. GitPython's GitHub Security Advisory reports a live-verified proof of concept on tag 3.1.53. ([github.com](https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf))
Affected: GitPython <= 3.1.53 ([github.com](https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf))
Fix: GitPython >= 3.1.54 ([github.com](https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf))
Action: Map CVE-2026-73623 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-73623)
Finding 05 — Tapo C120 v1 and C200 v5 contain an improper authentication vulnerability within the login authentication verification module.
What changed: Tapo C120 v1 and C200 v5 contain an improper authentication vulnerability within the login authentication verification module. An attacker on the local network can exploit weaknesses in challenge parameter validation to bypass normal authentication controls and obtain administrative session tokens.
Technical evidence: CVE-2026-15315; CVSS v4.0 8.7; weakness CWE-287; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Segment IoT cameras from other network zones and monitor traffic entering and leaving that segment. CISA Coordinator's SSVC assessment reports exploitation as 'none'. ([ftc.gov](https://www.ftc.gov/business-guidance/resources/careful-connections-keeping-internet-things-secure), [services.nvd.nist.gov](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-15315), [tp-link.com](https://www.tp-link.com/us/support/faq/5248/))
Affected: Tapo C120 v1 firmware before 1.9.3 Build 260521; Tapo C200 v5 firmware before V5_1.4.6 Build 260709 Rel.27675n. ([services.nvd.nist.gov](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-15315))
Fix: Tapo C120 V1: 1.9.3 Build 260521; Tapo C200 V5: V5_1.4.6 Build 260709 Rel.27675n. ([tp-link.com](https://www.tp-link.com/us/support/faq/5248/))
Action: Map CVE-2026-15315 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-15315)
Finding 06 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
What changed: IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. CVE coverage: CVE-2026-18824.
Technical evidence: CVE-2026-18824; CVSS v3.1 8.4; weakness CWE-78; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: For CVE-2026-13732, Red Hat advises removing .stab and .stabstr sections before opening untrusted ELF binaries in GDB. It also advises sandboxing or containerising automated GDB analysis of potentially untrusted binaries with restricted filesystem access. Red Hat reports that CVE-2026-13732 was demonstrated under controlled conditions to execute arbitrary commands within GDB. ([ibm.com](https://www.ibm.com/support/pages/node/7283858), [access.redhat.com](https://access.redhat.com/security/cve/CVE-2026-13732))
Affected: IBM lists affected bos.mp64 filesets as 7.2.5.0-7.2.5.212, 7.3.2.0-7.3.2.5, 7.3.3.0-7.3.3.2 and 7.3.4.0-7.3.4.1; Red Hat lists GDB as affected in RHEL 6, 7, 8, 9 and 10. ([ibm.com](https://www.ibm.com/support/pages/node/7283858), [access.redhat.com](https://access.redhat.com/security/cve/CVE-2026-13732))
Fix: IBM's remediation levels are AIX 7.3 TL04 SP2, 7.3 TL03 SP3, 7.3 TL02 SP5 and 7.2 TL05 SP13; and VIOS 4.1.2.20, 4.1.1.30 and 4.1.0.50. ([ibm.com](https://www.ibm.com/support/pages/node/7283858))
Panel assessment: Patch now for AIX/VIOS systems that permit remote authenticated access, and prioritise GDB wherever analysts or automation open externally supplied ELF files: the IBM issue is OS command injection, while the GDB issue has controlled command-execution proof and can turn routine analysis into execution. (priority: patch now)
Action: Map CVE-2026-18824 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-13732)
Finding 07 — MOOS core-moos: Uncontrolled Resource Consumption
What changed: MOOS core-moos through 10.4.0 contains a denial of service vulnerability in MOOSCommServer::ListenLoop() where the accept thread performs a blocking receive without timeout during the wire-protocol handshake. An attacker can open a TCP connection to the MOOSDB port and send no data, causing the accept thread to block indefinitely while holding the socket-list lock, preventing all subsequent client connections.
Technical evidence: CVE-2026-85443; CVSS v4.0 8.7; weakness CWE-400; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Restrict network access to the MOOSDB port to trusted hosts using a firewall or network segmentation. Monitor for repeated connection attempts to the MOOSDB port. ([app.opencve.io](https://app.opencve.io/cve/CVE-2026-85443), [github.com](https://github.com/themoos/core-moos/pull/83))
Panel assessment: Patch now where MOOSDB is reachable from untrusted networks: the record describes a public PoC and a low-effort unauthenticated TCP handshake stall that can block all subsequent client connections, so blast radius is service availability rather than code execution. The likely attack path is direct access to the MOOSDB port, opening a connection and sending no data, which disrupts MOOS client operations rather than reaching credentials or data. (priority: patch now)
Action: Map CVE-2026-85443 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-85443)
Finding 08 — MOOS-IvP uFldShoreBroker: Allocation of Resources Without Limits or Throttling
What changed: MOOS-IvP uFldShoreBroker through 24.8.1 fails to limit the number of claimed communities stored in parallel vectors within ShoreBroker::handleMailNodePing(). A single publisher can supply unbounded distinct community names to grow retained state and per-pass work without limit, causing memory exhaustion and performance degradation.
Technical evidence: CVE-2026-85448; CVSS v4.0 8.7; weakness CWE-770; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Restrict network reachability to uFldShoreBroker so only approved publishers can send node-ping data. Monitor for continually growing numbers of distinct claimed community names, increasing memory consumption and degraded performance. ([secalerts.co](https://secalerts.co/vulnerability/CVE-2026-85448), [github.com](https://github.com/moos-ivp/moos-ivp/pull/133))
Panel assessment: Patch this week, and sooner for any broker reachable by unapproved publishers, because the PoC shows a single node-ping sender can drive unbounded retained state and per-pass work, turning exposure into an availability failure rather than a theoretical bug. (priority: this week)
Action: Map CVE-2026-85448 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-85448)
Finding 09 — MOOS-IvP pMarineViewer: Allocation of Resources Without Limits or Throttling
What changed: MOOS-IvP pMarineViewer through 24.8.1 fails to limit the number of tracked node identities from NODE_REPORT messages, allowing attackers to exhaust memory by supplying unbounded distinct node names. Attackers can publish crafted NODE_REPORT data to cause memory exhaustion and stall the operator display without authentication.
Technical evidence: CVE-2026-85449; CVSS v4.0 8.7; weakness CWE-770; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Restrict untrusted publishers from sending NODE_REPORT and NODE_REPORT_LOCAL messages to pMarineViewer, and monitor for bursts of distinct NAME values alongside abnormal RSS or CPU growth. The pull-request author reports testing a 4,000-name flood against a live pMarineViewer instance, with substantial RSS and CPU growth. ([github.com](https://github.com/moos-ivp/moos-ivp/pull/134), [vulncheck.com](https://www.vulncheck.com/advisories/moos-ivp-through-24.8.1-pmarineviewer-unbounded-memory-consumption-via-node-report))
Affected: MOOS-IvP pMarineViewer versions up to and including 24.8.1. ([vulncheck.com](https://www.vulncheck.com/advisories/moos-ivp-through-24.8.1-pmarineviewer-unbounded-memory-consumption-via-node-report))
Action: Map CVE-2026-85449 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-85449)
Finding 10 — OpenPanel before 2.3.0 fails to properly validate chart formula expressions.
What changed: OpenPanel before 2.3.0 fails to properly validate chart formula expressions, allowing authenticated project members with read access to execute arbitrary code by recovering the native JavaScript Function constructor through mathjs matrix objects. Attackers can use the recovered constructor to load Node.js built-ins and execute operating system commands with the privileges of the API process, bypassing organization authorization boundaries.
Technical evidence: CVE-2026-85610; CVSS v4.0 8.7; weakness CWE-94; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Run the API image as a non-root user and use least-privilege service credentials. OpenPanel's GitHub Security Advisory publishes an attached verifier that demonstrates command execution through the HTTPS endpoint. ([github.com](https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-7476-c5cc-8999))
Affected: OpenPanel API (self-hosted) 2.2.0. ([github.com](https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-7476-c5cc-8999))
Fix: 2.3.0. ([github.com](https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-7476-c5cc-8999))
Panel assessment: Patch self-hosted OpenPanel API 2.2.0 to 2.3.0 now: read-level project membership is enough to reach API-process command execution, and the published verifier makes the path practical rather than theoretical. (priority: patch now)
Action: Map CVE-2026-85610 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-85610)
Finding 11 — SiYuan: Allocation of Resources Without Limits or Throttling
What changed: SiYuan before v3.8.2 contains a denial of service vulnerability in the unauthenticated /api/system/uiproc endpoint that accepts and retains attacker-controlled process identifiers without size limits or authentication. Attackers can send repeated requests with unique identifiers to exhaust process memory and degrade service availability.
Technical evidence: CVE-2026-85581; CVSS v4.0 8.7; weakness CWE-770; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Restrict network exposure of the SiYuan kernel/API port, place it behind an authenticated reverse proxy or VPN, and monitor abnormal memory growth or repeated requests to /api/system/uiproc. ([ionix.io](https://www.ionix.io/threat-center/cve-2026-85581/), [github.com](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-wv96-wmf5-xvj2))
Action: Map CVE-2026-85581 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-85581)
Finding 12 — SiYuan: Allocation of Resources Without Limits or Throttling
What changed: SiYuan versions before v3.8.2 contain a denial of service vulnerability in the publish-service Basic Auth throttle that stores failed-attempt state using attacker-controlled usernames without enforcing capacity limits or eviction policies. Unauthenticated attackers can submit repeated authentication requests with unique invalid usernames to exhaust memory and increase synchronization overhead, degrading service availability.
Technical evidence: CVE-2026-85584; CVSS v4.0 8.7; weakness CWE-770; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Restrict network exposure of the publish-service authentication endpoint by placing it behind a VPN or IP allow-list. Apply reverse-proxy rate limiting. ([ionix.io](https://www.ionix.io/threat-center/cve-2026-85584/), [github.com](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2x7j-p79w-7744))
Affected: v3.8.1 and earlier versions retaining the throttle-map design ([github.com](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2x7j-p79w-7744))
Fix: v3.8.2 ([github.com](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2x7j-p79w-7744))
Action: Map CVE-2026-85584 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-85584)
Finding 13 — insights-client: Insertion of Sensitive Information into Log File
What changed: A flaw was found in insights-client. The setDefault() function logs the value of every environment variable it processes, including CCX_TOKEN, a bearer credential used in disconnected cluster deployments.
Technical evidence: CVE-2026-71845; CVSS v3.1 6.3; weakness CWE-532; technical confidence High.
Why it matters: The Medium priority requires exposure validation and scheduled remediation through normal change control.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2026-71845 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-71845)
Finding 14 — light0011 cms: Authorization Bypass Through User-Controlled Key
What changed: A vulnerability was identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is the function AuthController::_initialize of the file App/Admin/Controller/ChapterController.class.php of the component Chapter Controller.
Technical evidence: CVE-2026-85378; CVSS v4.0 6.9; weakness CWE-639, CWE-285; technical confidence Medium.
Why it matters: The Medium priority requires exposure validation and scheduled remediation through normal change control.
Analyst note: Restrict administrative endpoints to trusted IP addresses using firewall or reverse-proxy access-control lists. VulDB reports that a public proof-of-concept exploit is available. ([vuldb.com](https://vuldb.com/cve/CVE-2026-85378), [vuldb.com](https://vuldb.com/vuln/398532), [cve.org](https://www.cve.org/CVERecord?id=CVE-2026-85378))
Affected: Commits c774dce31c6df0055568a8d5c53d964d99be199d and f72cf46f601efb2a0618c3814cc2f61380b38930. ([cve.org](https://www.cve.org/CVERecord?id=CVE-2026-85378))
Action: Map CVE-2026-85378 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-85378)
Finding 15 — A security flaw has been discovered in code-projects Hospital Information System 1.0.
What changed: A security flaw has been discovered in code-projects Hospital Information System 1.0. Affected by this vulnerability is the function getSinglePresp of the file includes/presp/PrespController.php.
Technical evidence: CVE-2026-85399; CVSS v4.0 6.9; weakness CWE-89, CWE-74; technical confidence Medium.
Why it matters: The Medium priority requires exposure validation and scheduled remediation through normal change control.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2026-85399 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-85399)