Analysis

CVE-2026-52785 is a critical SQL injection flaw in the timestamps functionality of OpenProject, an open-source web-based project management application. The description states that versions prior to 17.3.3 and 17.4.1 are affected and that the issue is fixed in 17.3.3 and 17.4.1. The sources consulted do not confirm any exploitation in the wild.

CVE-2026-13776 is a type confusion issue in Dawn in Google Chrome versions prior to 150.0.7871.47. According to the record, a remote attacker who had already compromised the renderer process could potentially escape the sandbox through a crafted HTML page. NVD assigns a CVSS 3.1 base score of 9.8, and the record does not list the issue in CISA KEV.

CVE-2026-54820 is an unauthenticated SQL Injection (CWE-89) in JetBooking versions up to and including 4.0.4.1, as described by the CNA Patchstack. The CNA assigned a CVSS 3.1 base score of 9.3 (critical). The record lists no affected or fixed version data, and no confirmed exploitation appears in the sources consulted.

CVE-2026-12411 is a broken access control flaw in the devLXDInstancePatchHandler component of Canonical LXD, listed in the record as affecting versions from 6.6 up to but not including 6.9. When a specific setting is enabled, an untrusted guest may be able to mount, read and overwrite another guest's custom storage volume. NVD scores it 9.6 (critical) and the Ubuntu CNA scores it 8.4; CISA KEV does not list it and no confirmed exploitation appears in the sources consulted.

Coolify, a self-hostable tool for managing servers and applications, has a cross-team authorization flaw in several Livewire web UI components. These components accept server and destination identifiers from URL query parameters without team ownership checks, which allows cross-team resource deployment. The GitHub advisory source rates it critical (CVSS 3.1 base score 9.6), it is fixed in 4.0.0-beta.474, and no confirmed exploitation appears in the sources consulted.

IBM has disclosed CVE-2026-10560, a missing authentication weakness in IBM Langflow OSS versions 1.0.0 through 1.9.6. According to the record, an unauthenticated party can read build event data or cancel jobs when a valid job identifier is known, leading to information disclosure and denial of service. NVD rates it critical with CVSS 3.1 score 9.1, while IBM's own score is 8.2.

CVE-2026-9711 is a critical SQL Injection flaw (CWE-89) in the EventON virtual event calendar plugin for WordPress, affecting versions up to and including 5.0.11. The record states that an unauthenticated attacker can reach the database through the WordPress 'search' parameter when the 'Enable additional search queries' setting is on and at least one published event exists. The record reports no confirmed exploitation and no KEV listing, and it does not provide a fixed version.

IBM has disclosed CVE-2026-7803, affecting Langflow OSS versions 1.0.0 through 1.10.0. The flaw stems from improper validation of flow nodes with missing or empty component type fields, which could allow arbitrary code execution. The record assigns a CVSS 3.1 base score of 9.8 and lists no fixed version, so administrators should consult the IBM advisory and reduce exposure in the meantime.

Wizarr versions before 2026.9.1 evaluate wizard step Markdown in a non-sandboxed template environment, so an authenticated user who can create steps, or an administrator importing an untrusted bundle, may be able to run arbitrary Python. The record describes possible operating-system command execution, disclosure of the Flask secret key and connected service credentials, and stored cross-site scripting. The issue is fixed in 2026.9.1, and no confirmed exploitation appears in the sources consulted.

IBM Business Automation Manager Open Editions is affected by an XML external entity injection (XXE) weakness that a remote attacker could use to expose sensitive information or consume memory. NVD scores it 9.1 (critical) under CVSS 3.1, while the CNA IBM scores it 7.6. The record lists no fixed version and no listing in the CISA KEV catalog.

CVE-2026-56059 is a critical arbitrary file upload vulnerability in Travel Booking, affecting versions up to and including 2.2.5, as reported by Patchstack. The CNA assigns CVSS 3.1 9.9 and CWE-434, and the record requires only Subscriber-level privileges. The record shows no fixed version and no confirmed exploitation in the sources consulted.

CVE-2026-37637 is a code injection weakness (CWE-94) reported in Alexantr filemanager v1.0 through its filemanager.php component, which the record says allows a remote attacker to execute arbitrary code. The CVSS 3.1 score in the record is 9.1 (Critical), but no affected-version or fixed-version data is provided. No confirmed exploitation appears in the sources consulted.

CVE-2026-13775 is a use-after-free flaw in the GPU component of Google Chrome prior to 150.0.7871.47. According to the record, an attacker who had already compromised the renderer process could potentially escape the sandbox through a crafted HTML page. The NVD lists a CVSS 3.1 base score of 9.8 (Critical), and no confirmed exploitation appears in the sources consulted.

CVE-2026-56033 describes an unauthenticated privilege escalation issue in Dokan Pro versions up to and including 5.0.4, mapped to CWE-266. The CNA Patchstack assigns a CVSS 3.1 base score of 9.8 (critical). The record does not list structured affected or fixed versions, and CISA KEV does not list it.

IBM has disclosed a cross-site scripting vulnerability in the administrative console help system of WebSphere Application Server 8.5 and 9.0. The CNA rates it critical with a CVSS 3.1 base score of 9.3, and the record lists affected ranges below 8.5.5.31 and 9.0.5.29. No confirmed exploitation appears in the sources consulted, and the CVE is not listed in CISA KEV.