Analysis

CVE-2026-8507 affects Crypt::OpenSSL::PKCS12 for Perl, with the affected range recorded as versions through 1.94. Processing a crafted PKCS12 file through info() or info_as_hash() can trigger a heap out-of-bounds write caused by a signed integer overflow, with potential for remote code execution. Both recorded CVSS 3.1 scores are 9.8, and no confirmed exploitation appears in the sources consulted.

A command injection weakness (CWE-77) has been reported in the setMacFilterRules function of the web management interface of Totolink A8000RU firmware version 7.1cu.643_b20200521. The record states the issue can be triggered remotely and that a public exploit has been made available, with a CVSS 3.1 base score of 9.8 from the CNA VulDB. No CISA KEV listing or confirmed exploitation in the wild appears in the sources consulted, and no fixed version is listed in the record.

A command injection flaw (CWE-77) affects the Web Management Interface of the Totolink A8000RU router running version 7.1cu.643_b20200521. The record reports that remote exploitation is possible and that a public exploit has been released, with a CVSS 3.1 base score of 9.8 from VulDB. No confirmed exploitation in the wild appears in the sources consulted, and no fixed version is listed.

CVE-2026-7251 describes a hard-coded password in the VNC server of the Eppendorf BioFlo 320. According to the record, a remote attacker who knows the network address of a model with remote access enabled could gain full control of the user interface. The record rates it critical (CVSS v3.1 9.8, CVSS v4.0 9.3), but lists no affected or fixed versions and no confirmed exploitation.

CVE-2026-39405 affects Frappe LMS versions 2.50.0 and below. A user with the course editing role could upload a SCORM ZIP package to write files outside the intended directory, a path traversal classified as CWE-22. The record states the issue is resolved in version 2.50.1, and no confirmed exploitation appears in the sources consulted.

CVE-2026-5118 affects the Divi Form Builder plugin for WordPress up to and including version 5.1.2. According to the record, the plugin accepts a user-controlled 'role' value during registration without validating it against the form's default_user_role setting, which may allow unauthenticated users to create administrator accounts. The record reports a CVSS 3.1 base score of 9.8 and no confirmed exploitation.

A path traversal weakness (CWE-22) in the WebinarIgnition WordPress plugin, from Saleswonder Team, is reported to allow arbitrary file deletion, with affected versions listed through 4.08.253. Patchstack assigned a CVSS 3.1 base score of 9.9 (critical). The record shows no CISA KEV listing and no confirmed exploitation in the sources consulted.

A critical OS command injection flaw in the setFirewallType function of the Totolink A8000RU web management interface (firmware 7.1cu.643_b20200521) can be triggered remotely through the firewallType argument. The record reports a CVSS 3.1 score of 9.8 and a publicly disclosed exploit, but no fixed version is listed. No confirmed active exploitation appears in the sources consulted.

CVE-2026-9543 is a critical OS command injection flaw in the setPasswordCfg function of /cgi-bin/cstecgi.cgi in the web management interface of Totolink N300RH version 6.1c.1353_B20190305. According to the record, the admpass argument can be manipulated to run operating system commands remotely. The CNA VulDB assigned a CVSS 3.1 base score of 9.8, and the exploit has been publicly disclosed, but no fix is listed in the record.

FACTION versions prior to 1.8.3 allow unauthenticated requests to reach Struts2 actions and BoilerPlateConfig methods that should require a valid session. An attacker could read, overwrite, deactivate and permanently delete boilerplate templates. GitHub reports a CVSS 3.1 score of 9.8, and the record does not list the CVE in CISA KEV or any confirmed exploitation.

OpenMRS Core evaluates criteria strings stored in concept reference ranges as Apache Velocity templates without a sandbox, which the record classifies as CWE-94 code injection. A user with the Manage Concepts privilege can store malicious template content that runs automatically during observation validation. The issue is fixed in 2.7.9 and 2.8.6, and the record shows no KEV listing or confirmed exploitation.

CVE-2026-6555 affects the ProSolution WP Client plugin for WordPress in versions up to and including 2.0.0. According to the record, only the first file in an upload array is validated for extension and MIME type, while all files are stored in a web-accessible directory, which may allow unauthenticated arbitrary file upload. The CNA rates it critical with a CVSS 3.1 score of 9.8, and no confirmed exploitation appears in the sources consulted.

Crypt::SaltedHash for Perl, in versions through 0.09, generates salts with the built-in rand function, which is predictable and unsuitable for cryptography. The CNA rates the issue as Critical with a CVSS 3.1 base score of 9.1. The record does not list affected or fixed versions in structured form, and no confirmed exploitation appears in the sources consulted.

Honeywell Control Network Module (CNM) contains a command injection flaw (CWE-77) in its web interface that could potentially lead to remote code execution. The record rates it critical with a CVSS 3.1 base score of 9.1. The record lists affected versions from 100.1 to 110.2 and no fixed version, and the vendor recommends moving to its most recent release.

CVE-2026-42773 is a blind SQL Injection flaw (CWE-89) in eMagicOne Store Manager, described as affecting versions through 1.3.2. Patchstack assessed it with a CVSS 3.1 base score of 9.3 (critical). The record shows no fixed version, and no confirmed exploitation appears in the sources consulted.