VulnCheck's Canaries Caught Six Exploited CVEs CISA Hasn't Listed: XWiki, MantisBT, Yamcs, openDCIM, madong-admin and a Rejected Open WebUI Record
VulnCheck's Known Exploited Vulnerabilities list now carries six CVEs whose exploitation its own canaries, its honeypot fleet, reported between Thursday November 12 and Saturday November 14, 2026. None of the six is in the CISA KEV catalog (version 2026.11.13, 1,781 entries, read November 15). If you run any of these products, here is what to do first.
Do this now
XWiki on Jetty 12 or later: upgrade to 17.10.5 or 18.2.0 or later (CVE-2026-34151). If you cannot upgrade today, the XWiki advisory names Tomcat, or Jetty before 12 on XWiki before 17, as not affected.
MantisBT on MySQL or MariaDB: upgrade to 2.28.1 or later; the current release line is 2.28.4 (CVE-2026-30849). Until then, disable the SOAP API, which the vendor says significantly reduces the risk but still leaks user names, email addresses and real names.
Yamcs: upgrade to 5.12.8 or 5.13.2 or later (CVE-2026-55559). If you have no security.yaml, your instance API runs as a guest superuser with no login. Put it behind authentication and off the internet regardless of version.
madong-admin-saas: upgrade to 5.1.5 or later (CVE-2026-120446). Block anonymous access to /platformapi/ at your proxy until you do.
openDCIM: there is no upstream fix we could find (CVE-2026-28516). The 26.01 release of October 26, 2026 still builds the vulnerable SQL string. Remove or block install.php and container-install.php from the network, restrict the application to trusted networks, and if you run the Docker image, note that its Dockerfile links install.php to container-install.php. The reporter's proposed patch is GitHub pull request 1664, which the project closed unmerged.
Open WebUI: there is no patch because the vendor says there is no bug (CVE-2026-0766, now REJECTED). Anyone holding the admin role or the workspace.tools permission can run Python on your server by design. Do not grant workspace.tools to anyone you would not hand a shell, turn off open sign-up, and keep the instance off the open internet.
What is confirmed
For each CVE we read VulnCheck's KEV record directly from the VulnCheck API. Every one of the six carries reported_exploited_by_vulncheck_canaries set to true. VulnCheck's date_added is its earliest exploitation evidence, not the day the entry appeared, and each record points to a canary observation on that same date.
CVE-2026-34151, XWiki Platform. Path traversal in the /skin/ action (SkinAction): when Jetty 12 or later decodes a double-encoded parent-directory segment, the lookup escapes the skin prefix. Unauthenticated. The advisory's own examples read WEB-INF/xwiki.cfg and, in the Docker image layout, /etc/passwd, so the realistic loss is configuration secrets including database credentials. Affected: xwiki-platform-oldcore before 17.10.5, and 18.0.0-rc-1 up to before 18.2.0. Fixed in 17.10.5 and 18.2.0. GitHub advisory GHSA-qj4x-9g63-25g6, published July 7, 2026; NVD record published September 14, 2026 (status Deferred). VulnCheck canary evidence: November 14, 2026.
CVE-2026-30849, MantisBT. Authentication bypass in the SOAP API on MySQL-family databases, from improper type checking of the password parameter. An attacker who knows a username can log in to the SOAP API as that user without the password and call any function that user can. Other database backends are not affected. Affected: before 2.28.1. Fixed in 2.28.1 (commit b349e5c8, March 16, 2026). Advisory GHSA-phrq-pc6r-f6gh, credited to Alexander Philiotis of SynerComm. NVD scores it 9.8. VulnCheck lists a public proof of concept in its exploit database from June 6, 2026. VulnCheck canary evidence: November 12, 2026.
CVE-2026-55559, Yamcs (Space Applications Services' mission control framework). The templateArgs sent to POST /api/instances and PATCH /api/instances/{instance} are written into YAML without escaping, so an attacker can inject a services entry for org.yamcs.ProcessRunner and run commands as the Yamcs service account. It needs the CreateInstances privilege, but a deployment without security.yaml grants that to an unauthenticated guest superuser. Affected: up to 5.12.7, and 5.13.0 through 5.13.1. Fixed in 5.12.8 and 5.13.2 (both released July 14, 2026). Advisory GHSA-73mf-m39p-wpm9, published August 28, 2026, rated critical. VulnCheck canary evidence: November 14, 2026.
CVE-2026-120446, madong-admin-saas. In multi-tenant mode the platform tenant-management API is unauthenticated, because the middleware configuration keys on platformapi while the application is named platform. Anonymous callers can reach /platformapi/tenant/account, bind-plan and sync-data to list, create, modify, disable or delete tenants. Affected: through 5.1.4. The maintainer's fix is commit 2a199a15 (November 2, 2026), which closes GitHub issue 2 and ships in tag v5.1.5 (November 5). VulnCheck is the CNA; its CVSS 3.1 score is 9.4. VulnCheck canary evidence: November 12, 2026, ten days after the fix and seven days after the release.
CVE-2026-28516, openDCIM. SQL injection in Config::UpdateParameter, reached from the LDAP form in install.php and container-install.php, which interpolate request values straight into SQL. The CVE text says an authenticated user can run arbitrary SQL. The reporter, Chocapikk, chains it with CVE-2026-28515 (the same form never checks for a site administrator) and CVE-2026-28517 (a command injection in the network map report) to reach code execution, and argues in the pull request that Docker deployments are reachable without authentication. The maintainer replied that install.php is supposed to be removed after installation. We compared Config::UpdateParameter at the vulnerable commit 4467e9c4 with the 26.01 release tag: the function is byte-for-byte the same string-built query. Affected: 23.04 through at least 26.01, by our reading of the code. Fixed: none we could find. A public exploit has been on GitHub since February 27, 2026. VulnCheck canary evidence: November 12 and November 13, 2026.
CVE-2026-0766, Open WebUI. Issued by the Zero Day Initiative as ZDI-26-032 in January 2026: load_tool_module_by_id passes a Tool's Python source to exec(). Open WebUI disputed it as intended behavior: Tools are a feature for running user-written Python on the server, gated by the admin role or the workspace.tools permission, which is off by default. ZDI agreed, and on September 2, 2026 the record was set to REJECTED at CVE.org and NVD. VulnCheck still lists it, with canary evidence on November 14, 2026, and a public proof of concept in its exploit database from April 2, 2026. Both statements can be true. A designed code-execution feature is still code execution for whoever reaches it with the right role, and an instance that hands workspace.tools to self-registered users, or leaks an admin password, gives it away.
None of the six is in CISA KEV as of catalog version 2026.11.13.
What is not known
What VulnCheck's canaries actually saw. The per-CVE canary detail sits behind VulnCheck's paid Canary Intelligence subscription, which we do not hold, so we cannot tell you source addresses, request volume, or whether the traffic was a scan or a working exploit. The KEV record says only that its canaries reported exploitation on those dates.
Who is behind it, and whether any real (non-canary) victim exists. No source we read names an actor or a victim.
For Open WebUI: whether the canary traffic used a stolen or default admin credential, an open sign-up instance, or something else. The record does not say.
For openDCIM: whether a patch exists in a branch or fork we did not check. We checked the main repository's releases and the 26.01 tag only.
Indicators: no indicators published in the sources we read. We added none to our feed.
What our edge saw
Nothing specific to these six. We scanned every edge instrument we have from September 1 to November 15, 2026: 449,057 edge-block records, 114,545 edge canary records and 2,377 origin honeypot captures. None of our own /post/ pages matched any of the patterns, so there was nothing of ours to remove.
XWiki (/bin/skin/): 0 in all three.
Yamcs (/api/instances): 0 in all three.
madong-admin-saas (/platformapi): 0 in all three.
MantisBT (mantisconnect or /api/soap/): 0 in all three.
Open WebUI (/api/v1/tools/ or /api/v1/functions/ create and id routes): 0 in all three.
openDCIM: 0 hits on container-install.php, report_network_map or the ldapaction parameter. We did see 3 blocked requests for a bare /install.php from 2 addresses (November 9 and 12), and 486 canary hits on /wp-admin/install.php. Those are generic installer recon, mostly WordPress, and an /install.php probe says nothing about which product the scanner hoped to find. We do not count any of them as an openDCIM sighting.
Read those zeros carefully. We run none of these products, and we have no canary trap shaped like any of them, so a scanner hunting for XWiki or Yamcs had no reason to linger on our zones. Zero here means we were not probed on these paths, not that nobody is exploiting them. VulnCheck's canaries are built to look like these targets; ours are not.
How we know
We check exploited-CVE lists (CISA KEV, VulnCheck KEV, NVD) against this blog every day by exact CVE id. On November 15 these six came up as exploited, canary-sighted, and never mentioned here. We then read each VulnCheck KEV record through the VulnCheck API, the CISA KEV JSON feed, each NVD record through the NVD API, each GitHub security advisory, the openDCIM and madong-admin-saas repositories (commits, tags, issue and pull request threads), and Open WebUI's vendor disposition page. We did not detect any of these first, and this post claims no lead. VulnCheck's canaries saw the exploitation; we are passing it on to readers who do not watch VulnCheck's list, because CISA has not listed any of these yet.
We are confident in the versions and fix status above to the extent the primaries are; call it 95%, never 100%. The openDCIM "no fix" finding is our own code comparison and could be wrong if a fix landed somewhere we did not look.
Sources
VulnCheck KEV: https://vulncheck.com/kev (records read through api.vulncheck.com, index vulncheck-kev, November 15, 2026)
CISA KEV JSON, catalog 2026.11.13: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-34151, https://nvd.nist.gov/vuln/detail/CVE-2026-30849, https://nvd.nist.gov/vuln/detail/CVE-2026-55559, https://nvd.nist.gov/vuln/detail/CVE-2026-120446, https://nvd.nist.gov/vuln/detail/CVE-2026-28516, https://nvd.nist.gov/vuln/detail/CVE-2026-0766
XWiki advisory: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qj4x-9g63-25g6
MantisBT advisory: https://github.com/mantisbt/mantisbt/security/advisories/GHSA-phrq-pc6r-f6gh
Yamcs advisory: https://github.com/yamcs/yamcs/security/advisories/GHSA-73mf-m39p-wpm9
madong-admin-saas fix and issue: https://github.com/madong-code/madong-admin-saas/commit/2a199a1523ed749c94b876bc2ae5fedf252b2e39 and https://github.com/madong-code/madong-admin-saas/issues/2
VulnCheck madong advisory: https://www.vulncheck.com/advisories/madong-admin-saas-through-5.1.4-missing-authentication-via-platform-tenant-management-api
openDCIM pull request 1664 (closed, unmerged): https://github.com/opendcim/openDCIM/pull/1664
VulnCheck openDCIM advisory: https://www.vulncheck.com/advisories/opendcim-sql-injection-in-config-updateparameter
Chocapikk write-up: https://chocapikk.com/posts/2026/opendcim-sqli-to-rce/
openDCIM 26.01 release: https://github.com/opendcim/openDCIM/releases/tag/26.01
Open WebUI vendor disposition: https://docs.openwebui.com/security/vendor-dispositions/cve-2026-0766
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments