Analysis

CVE-2026-48286 is an Incorrect Authorization weakness (CWE-863) in Adobe Campaign Classic (ACC) 7.4.3 build 9396 and earlier, which the record says could allow arbitrary code execution in the context of the current user. The CNA rates it critical with a CVSS 3.1 base score of 10 and no user interaction required. No confirmed exploitation appears in the sources consulted, and the record lists no fixed version.

CVE-2026-13762 is a critical issue (CVSS 3.1 base score 9.8, as published by the CNA) in Amazon CloudFront with AWS WAF enabled. Crafted HTTP/2 requests that split the body across frames may cause WAF managed rule body inspection to examine only part of the body. The source states the issue was fixed server-side and that no customer action is required.

CVE-2026-13751 is a server-side request forgery weakness (CWE-829) in Snowflake CLI versions from 1.1.0 before 3.19. The SQL statement reader's !source and !load directives can fetch remote URLs without sufficient restriction on the destination, and the record says Snowflake fixed it in version 3.19. NVD rates it 9.6 (critical) under CVSS 3.1, but the record contains no confirmed exploitation.

IBM has published CVE-2026-7874, which affects Langflow OSS from 1.0.0 through 1.10.0. The record states that encryption at rest uses a weak and reversible key derivation mechanism, which could allow disclosure of all stored credentials. The record lists a CVSS 3.1 base score of 9.1 (Critical), and no confirmed exploitation appears in the sources consulted.

The ProfileGrid plugin for WordPress, in all versions up to and including 5.9.9.5, does not validate a registration parameter and mishandles error messages. An unauthenticated attacker could change the email address of account ID 1, usually an administrator, and use that to reset the password. The CVSS 3.1 score is 9.8 (Critical), and no fixed version is identified in the available record.

Apache Tomcat omits special roles and empty authorisation constraints when logging the effective web.xml, a CWE-670 flaw. The CNA rates it critical with a CVSS 3.1 score of 9.1 and recommends upgrading to fixed releases in each affected branch. The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted.

CVE-2026-48283 affects Adobe ColdFusion versions 2025.9, 2023.20 and earlier, and is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The record states that exploitation could lead to arbitrary code execution in the context of the current user, requires no user interaction, and changes scope. The CNA assigned a CVSS 3.1 base score of 10.0, and the record does not list fixed versions or confirmed exploitation.

IBM disclosed CVE-2026-7871, a critical deserialization of untrusted data flaw (CWE-502) in Langflow OSS versions from 1.0.0 through 1.10.0. According to the record, a user with Redis access can execute arbitrary code with full application privileges. The CNA-provided CVSS 3.1 base score is 9.8, and no confirmed exploitation appears in the sources consulted.

CVE-2026-48276 is a critical Unrestricted Upload of File with Dangerous Type (CWE-434) issue in Adobe ColdFusion, according to the CNA record. The description states it could allow arbitrary code execution in the context of the current user, without user interaction and with a changed scope. The record gives no fixed versions and no confirmed exploitation, so administrators should check the vendor advisory and apply it as soon as it is available.

CVE-2026-58138 describes an unauthenticated remote code execution flaw in Orkes Conductor, classified as code injection (CWE-94). According to the record, versions from 3.21.21 before 3.30.2 are affected when inline workflow definitions reach unsandboxed GraalVM evaluators before authentication. The CVSS 3.1 base score is 9.8 (Critical), and no confirmed exploitation appears in the sources consulted.

OpenProject, an open-source web-based project management tool, is affected by cache store poisoning that can lead to remote code execution, according to the GitHub advisory. The record fixes the issue in versions 17.3.3 and 17.4.1 and rates it critical with CVSS 3.1 base score 9.6. No confirmed exploitation appears in the sources consulted.

Budibase versions before 3.39.12 let an unauthenticated visitor of a published app read, and in some configurations modify, documents in backing data stores when the builder has exposed a query with the PUBLIC role. The flaw comes from unsafe construction of JSON query bodies from user-supplied parameters, and the advisory states it is fixed in 3.39.12. NVD rates it 9.8 (critical) under CVSS 3.1, and no confirmed exploitation appears in the sources consulted.

CVE-2026-54827 is a critical unauthenticated SQL injection in Real Estate 7, described as affecting versions up to 3.5.9. The record lists no fixed version and no confirmed exploitation in the sources consulted. Defenders should verify installed versions and apply general hardening until vendor guidance is confirmed.

CVE-2026-56057 is a PHP Object Injection vulnerability (CWE-502) affecting Uncanny Automator Pro versions up to and including 7.3.0.6, as reported by Patchstack. The record assigns a CVSS 3.1 base score of 9.8 with a network attack vector and no privileges required, and the CVE is not listed in CISA KEV. Fixed versions and affected version ranges are not provided in the available sources.

Advantech Hospital Queuing Management has a sensitive data exposure flaw, classified as missing authentication for a critical function (CWE-306), that lets unauthenticated remote attackers reach API documentation through a specific URL. The CVSS 3.1 base score is 9.8 (critical), and TWCERT/CC also reports a CVSS 4.0 score of 9.3. The record lists no affected or fixed versions, so administrators should consult the referenced advisories and restrict access to documentation endpoints.