Analysis

CVE-2026-44262 affects Dedoc Scramble, a tool that generates API documentation for Laravel projects, in versions from 0.13.2 before 0.13.22. When documentation endpoints are publicly reachable and validation rules reference user-supplied input, that input may be evaluated during documentation generation, which can lead to execution of arbitrary PHP code. The sources state the flaw is fixed in 0.13.22, and no confirmed active exploitation appears in the sources consulted.

CVE-2026-43899 affects DeepChat versions prior to v1.0.4-beta.1. The record describes an incomplete mitigation for CVE-2025-55733 that left native Electron pop-up handlers unsanitized, allowing a crafted Markdown link to reach shell.openExternal() and bypass the external URL validation. The CNA rates it critical with CVSS 3.1 score 9.6, and the fix is stated to be in v1.0.4-beta.1.

The Career Section WordPress plugin contains an arbitrary file upload flaw in its CV upload handler, caused by missing file type validation, in all versions up to and including 1.7. The CVSS 3.1 score from Wordfence is 9.8 (critical), and the description notes that unauthenticated attackers could upload potentially executable files, which may enable remote code execution. The record does not list a fixed version, and no KEV listing appears.

CVE-2026-13851 is an improper input validation issue in the WebAppInstalls component of Google Chrome on Android before 150.0.7871.47. The record states that a local attacker can bypass discretionary access control using a crafted HTML page. The CVE is not listed in CISA KEV and no confirmed exploitation appears in the sources consulted.

CVE-2026-77099 is a critical input validation issue in Commvault CVFS that the record classifies as OS command injection (CWE-78). The record reports a CVSS 4.0 score of 9.3 and lists affected ranges for Commvault Cloud and Grid(HSX) CVFS, but no fixed versions. No confirmed exploitation appears in the sources consulted.

CVE-2026-32661 is a critical stack-based buffer overflow (CWE-121) in GUARDIANWALL MailSuite and GUARDIANWALL Mail Security Cloud (SaaS version), reported through JPCERT/CC. The record describes possible arbitrary code execution after a remote, crafted request to the web service when pop3wallpasswd is configured to run with the grdnwww user privilege. No CISA KEV listing or confirmed exploitation appears in the sources consulted, and the record lists no fixed version.

CVE-2026-13872 is an improper input validation issue in the WebAppInstalls component of Google Chrome on Android, affecting versions prior to 150.0.7871.47. The record describes a local attacker using a malicious file to potentially escape the browser sandbox. The vendor fix is indicated by the affected version boundary, and the record reports a CVSS 3.1 base score of 9.1 with a network attack vector, which conflicts with the local attacker scenario described.

A Cross-Site Request Forgery flaw in the MISP Modules website affects versions 3.0.7 and earlier. The home blueprint was exempt from CSRF protection, which could let an attacker cause an authenticated user to send unintended requests. The record rates it critical (CVSS 4.0 score 9.3) and does not list it in CISA KEV.

Google Chrome on iOS builds prior to 150.0.7871.47 contain an improper input validation flaw (CWE-20). According to the record, a remote attacker who had already compromised the renderer process could potentially escape the sandbox through a crafted HTML page. The CNA rates it critical with a CVSS 3.1 score of 9.6, and the record shows no KEV listing; updating to 150.0.7871.47 or later is the main remediation step.

CVE-2026-7182 is a path traversal weakness (CWE-22) in the export module of Diagram. Missing HTML sanitization of the src attribute can allow local files from the server to appear in generated PDFs. CERT Polska scored it 9.2 under CVSS 4.0 (critical), and the description states the issue is fixed in version 1.1.1. No confirmed exploitation appears in the sources consulted.

CVE-2026-40621 affects ELECOM wireless LAN access point devices, which do not require authentication to reach some specific URLs, so the product may be operated without authentication. The CNA JPCERT/CC scores it 9.8 under CVSS 3.0 and 9.3 under CVSS 4.0. The record does not list affected models, versions or fixes, so administrators should consult the vendor and JVN advisories directly.

CVE-2026-8072 affects the local SAT (Technical Support) access function of the Ingecon Sun EMS Board. The secret access credentials were generated with a weak hashing algorithm rather than a secure cryptographic scheme, which could allow privilege escalation. The record provides no affected or fixed versions, and no confirmed exploitation appears in the sources consulted.

wger, a free open-source workout and fitness manager, has an Incorrect Authorization flaw (CWE-863) in its reset_user_password and gym_permissions_user_edit views. A gym-scope check using the != operator evaluates None != None as False, so the check is skipped for users without a gym assignment. The record describes this as enabling one-shot account takeover, and the issue is fixed in version 2.6.

CVE-2026-82103 is a sensitive information exposure issue (CWE-200) in IBM DataStage on Cloud Pak for Data version 5.4.0.0, which the CNA rates as critical with a CVSS 3.1 base score of 9.6. The sources consulted describe a remote attacker with low-privilege authentication who could obtain sensitive information. No confirmed exploitation appears in the sources consulted, and the record does not list fixed versions, so administrators should check the IBM vendor bulletin directly.

CVE-2026-6512 is a missing authorization flaw (CWE-862) in the InfusedWoo Pro plugin for WordPress, affecting all versions up to and including 5.1.2. According to the record, unauthenticated users could permanently delete content, mass-delete comments and change post status. Wordfence reports a CVSS 3.1 score of 9.1 (Critical), and no confirmed exploitation appears in the sources consulted.