Analysis

CubeCart versions prior to 6.7.0 contain an authenticated server-side template injection flaw in several modules, including email templates, invoices, documents and contact forms. User-supplied input is evaluated by the Smarty template engine without Smarty Security Policies enabled, which can allow an administrator-level user to run operating system commands on the server. The description states the issue is fixed in 6.7.0, and the GitHub advisory rates it 9.1 (critical) under CVSS 3.1.

soundcloud-rpc versions before 0.1.8 render SoundCloud track titles as raw HTML inside Electron views with Node.js integration enabled, so a crafted title can lead to command execution on the user's machine. The record rates the issue critical with a CVSS 3.1 score of 9.6 and states that it is fixed in 0.1.8. The sources consulted show no confirmed exploitation, and the CVE is not listed in CISA KEV.

Cleanuparr versions before 2.9.10 take the leftmost X-Forwarded-For entry as the client IP when reverse-proxy trusted-network mode is enabled, and that value is controlled by the remote client. This lets an unauthenticated remote attacker be logged in as the administrator. The record rates it Critical (CVSS 3.1 base score 9.8), states it is fixed in 2.9.10, and does not list it in CISA KEV.

HRConvert2 versions before 3.3.8 fail to remove backtick and tab characters in the sanitizeString() function, so user-supplied filenames can reach shell_exec() and trigger command execution. The GitHub CNA scores the issue 9.3 under CVSS 4.0 and the record shows no CISA KEV listing. Upgrading to 3.3.8 is the fix referenced by the sources.

CVE-2026-41050 is a critical incorrect-authorization flaw (CWE-863) in Fleet's Helm deployer, which did not fully apply ServiceAccount impersonation in two code paths. According to the record, a tenant with git push access to a Fleet-monitored repository could read secrets from any namespace on each downstream cluster targeted by their GitRepo. SUSE, as CNA, scored it 9.9 under CVSS 3.1, the CVE is not listed in KEV, and the record lists no fixed versions.

CVE-2026-13852 is an improper input validation flaw in the WebAppInstalls component of Google Chrome on Android, affecting versions prior to 150.0.7871.47 according to the record description. The CNA and CISA-ADP both list a CVSS 3.1 score of 9.1, but the vector's network attack vector does not match the description of a local attacker. No confirmed exploitation appears in the sources consulted.

CVE-2026-13782 is a use-after-free in the Browser component of Google Chrome, classified as CWE-416. According to the record, a remote attacker who had already compromised the renderer process could potentially escape the sandbox through a crafted HTML page. The description states the issue is fixed in Chrome 150.0.7871.47, and no confirmed exploitation appears in the sources consulted.

FearlessCMS versions 0.1.2b and earlier let an authenticated administrator point the built-in updater at an arbitrary Git repository, and the updater installs its content without verifying it. According to the description, this can lead to execution of arbitrary PHP with web server privileges and persistence as a backdoor. The issue is fixed in version 0.1.3b.

A use-after-free flaw in the Journeys feature of Google Chrome, described as affecting versions prior to 150.0.7871.47, could let a remote attacker who has already compromised the renderer process attempt a sandbox escape through a crafted HTML page. The record scores it 9.6 (critical) under CVSS and classifies it as CWE-416. The record shows no KEV listing, and no confirmed exploitation appears in the sources consulted.

CVE-2026-13882 is a race condition (CWE-362) in the USB component of Google Chrome prior to 150.0.7871.47. According to the record, a remote attacker who has already compromised the renderer process could potentially escape the sandbox using a crafted HTML page. The CNA and CISA-ADP report a CVSS 3.1 base score of 9.6, while the Chromium project rates the issue as Medium severity.

SiYuan's Bazaar community marketplace renders the name and version fields of package manifests into the Settings Marketplace interface without HTML escaping, which enables cross-site scripting. The CNA rates the issue critical with a CVSS 3.1 base score of 9. The sources state the issue is fixed in 3.7.0, and the record does not list it in CISA KEV.

CVE-2026-44257 affects efw4.X versions before 4.08.010, where the zip extraction routine does not verify that extracted paths stay inside the target directory. According to the record, an unauthenticated remote attacker could write files outside the intended folder and potentially run commands as the Tomcat service user. The CVSS 4.0 base score recorded is 9.3, and the vulnerability is not listed in CISA KEV.

CVE-2026-13861 is a use-after-free (CWE-416) in the Core component of Google Chrome. According to the description, a remote attacker who has already compromised the renderer process could potentially escape the sandbox using a crafted HTML page. The CVSS 3.1 base score of 9.6 is provided by the CNA and CISA-ADP, and the record shows no KEV listing or confirmed exploitation in the sources consulted.

CVE-2026-13859 affects Google Chrome versions before 150.0.7871.47 and stems from an inappropriate implementation in the ANGLE graphics component. A remote attacker could potentially escape the browser sandbox using a crafted HTML page. The record lists a CVSS 3.1 base score of 9.6 (critical) and Chromium security severity Medium, with no KEV listing and no confirmed exploitation in the sources consulted.

CVE-2026-44196 is a critical authentication bypass in Pingvin Share X, a self-hosted file sharing platform, described as affecting versions from 1.14.1 through 1.16.2. According to the record, an attacker who already holds a valid username and password can skip the TOTP second-factor requirement. The issue is fixed in 1.16.3, and no confirmed exploitation appears in the sources consulted.