Analysis

SOCFortress CoPilot versions before 0.1.57 fall back to a hardcoded JWT signing secret when JWT_SECRET is not set, including in the default Docker Compose setup. The record states that an unauthenticated attacker could use this publicly known value to forge administrator-scoped tokens and control the application. The issue is fixed in 0.1.57, and no confirmed exploitation appears in the sources consulted.

CVE-2026-45408 affects Dokku versions prior to 0.38.2. The app name validation permits shell metacharacters, and an authenticated user who pushes to a git remote with a crafted app name can cause arbitrary commands to run as the dokku user. The record reports a fix in 0.38.2 and a CVSS 3.1 score of 9.

IBM disclosed CVE-2026-7663 in Langflow OSS versions 1.0.0 through 1.9.6, where improper authorization enforcement in the Streamable MCP transport endpoint may let unauthenticated attackers reach protected MCP project resources. NVD scores it 9.8 (CVSS 3.1, critical), while IBM's score in the record is 9.1. No confirmed exploitation or fixed version appears in the sources consulted.

Apple has fixed an improper input validation flaw (CWE-20) across iOS, iPadOS, macOS, tvOS, visionOS and watchOS. The CNA rates it critical with a CVSS 3.1 score of 9.1, and the description says it can cause unexpected system termination or kernel memory corruption. No confirmed active exploitation appears in the sources consulted.

CVE-2026-56070 describes an unauthenticated SQL injection in Advance Product Search versions up to and including 1.4.4, classified as CWE-89. The CNA audit@patchstack.com assigned a CVSS 3.1 base score of 9.3 (critical) with a network attack vector and no privileges or user interaction required. The record does not provide a fixed version or affected product list, and the CVE is not listed in CISA KEV.

Booster for WooCommerce versions up to and including 8.0.1 contain an arbitrary file upload flaw reachable through customer functionality, classified as CWE-434. The CNA rates it critical with a CVSS 3.1 base score of 9.9. The record lists no fixed version and does not show a KEV listing or confirmed exploitation.

A reported issue in DokuWiki 2025-05-14b "Librarian" 56.2 allows a remote attacker to create an account through the register function in inc/auth.php. The CNA record rates it critical with a CVSS 3.1 score of 9.8, but the supplier disputes it, stating the behavior is intentional when self-registration is enabled, a non-default setting. No confirmed exploitation appears in the sources consulted.

CVE-2026-42882 affects oxyno-zeta/s3-proxy before 5.0.0. The authentication middleware and the bucket handler interpret the same request path differently, which can let unauthenticated network attackers reach protected S3 namespaces. The record describes a CVSS 3.1 score of 9.4 and a fix in 5.0.0; no confirmed exploitation appears in the sources consulted.

CVE-2026-49048 affects the JoomCCK extension for Joomla from Joomcoder, where a front-end controller task concatenates a user-supplied request parameter into two SQL statements without escaping or parameterisation. The CNA reports a CVSS 3.1 base score of 9.8 (critical) and a 4.0 score of 8.7. No confirmed exploitation appears in the sources consulted, and the record lists no fixed version.

IBM published CVE-2026-7873, a critical code injection weakness (CWE-94) in Langflow OSS versions 1.0.0 through 1.10.0, with a CVSS 3.1 base score of 9.9 assigned by IBM PSIRT. According to the record, an authenticated attacker can run operating system commands and read sensitive files, including credentials. The record lists no fixed version and no CISA KEV listing.

IBM has disclosed a server-side request forgery (SSRF) vulnerability in WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.7 when the adminCenter-1.0 feature is enabled. NVD scores it 9.8 (critical) under CVSS 3.1, while the IBM PSIRT score in the record is 7.1. The record shows no CISA KEV listing and no confirmed exploitation in the sources consulted.

CVE-2026-11708 is a cross-site scripting (XSS) flaw in the integrated help system of the administrative console of IBM WebSphere Application Server 8.5 and 9.0. IBM's CNA record assigns a CVSS 3.1 base score of 9.3 (Critical) with user interaction required. The sources consulted show no CISA KEV listing and no confirmed exploitation, and the record does not list an explicit fixed version.

CVE-2026-13763 is a critical issue in Amazon Application Load Balancer with AWS WAF enabled, where inconsistent interpretation of HTTP/2 requests may let remote actors evade managed rule body inspection. The CNA reports CVSS 3.1 9.8 and CVSS 4.0 7.9, and states that only HTTP/2 ALB target groups are affected. AWS documents a target group configuration, "Inspect after sufficient data", as the remediation path, and no confirmed exploitation appears in the sources consulted.

An unauthenticated SQL Injection flaw (CWE-89) affects Quotes llama versions up to and including 3.1.5. The CNA Patchstack rated it critical with a CVSS 3.1 base score of 9.3. The record shows no CISA KEV listing and no fixed version.

CVE-2026-56034 describes an unauthenticated SQL injection in Library Management System versions up to and including 3.5.7, classified as CWE-89. The CNA, Patchstack, assigned a CVSS 3.1 base score of 9.3 (Critical), but the record provides no fixed version and no structured affected-version data. No confirmed exploitation appears in the sources consulted.