Analysis

The mise development tool manager processes .tool-versions files through a template engine before version 2026.3.10, which the record describes as enabling arbitrary command execution. According to the record, a victim with mise activated who enters a malicious repository can be affected without a trust prompt in non-paranoid mode. The record gives a CVSS 3.1 base score of 9.6 (Critical), and no confirmed exploitation appears in the sources consulted.

Budibase versions before 3.39.0 expose an attachment upload URL endpoint without an authorization check. An unauthenticated caller who can identify a workspace and an S3 datasource may obtain a pre-signed write URL signed with the datasource's cloud credentials. The record states the issue is fixed in 3.39.0 and is not listed in CISA KEV.

Daktronics DMP-5000, DMP-8000 and VFC-DMP-5000 firmware ship with a default administrative web account that has weak authentication controls and is not required to be changed during setup or operation. According to the record, use of these accounts provides full system access. NVD rates the issue 9.8 (critical) under CVSS 3.1, and no confirmed exploitation appears in the sources consulted.

CVE-2026-48315 is a critical Improper Input Validation flaw (CWE-20) in Adobe ColdFusion, scored 9.3 under CVSS 3.1 by the CNA. The CNA description says it could lead to code execution in the current user's context and requires a victim to open a malicious file. The record shows no KEV listing and no fixed version, so defenders should consult Adobe advisory APSB26-68.

CVE-2026-54636 affects the cron plugin of Dokku before 0.38.7, where commands declared in app.json are not safely handled and can escape the container to run on the host as the Dokku user. The advisory rates it critical, with NVD scoring 9.9 and GitHub scoring 9. No confirmed exploitation appears in the sources consulted, and the fix is available in 0.38.7.

CVE-2025-11919 is a critical issue (CVSS 3.1 base score 9.6) in the default Java Virtual Machine, where files under the shared /tmp directory can influence which libraries the JVM loads from its classpath. The record does not name the affected product, versions, or a fixed version. No confirmed exploitation appears in the sources consulted.

CVE-2026-6213 affects Remote Spark SparkView before build 1122. The record describes a bypass of the local connection check that can lead to arbitrary code execution as root on the server, and the CNA scores it CVSS 4.0 10 (critical). No confirmed exploitation appears in the sources consulted, and the record lists no affected or fixed version ranges.

The User Verification plugin by PickPlugins for WordPress contains an authentication bypass (CWE-288) caused by a loose PHP comparison in its OTP login validation. According to the record, unauthenticated attackers could log in as any user with a verified email address, including administrators, and the CVSS score is 9.8 (critical). The record lists no fixed version, and no confirmed exploitation appears in the sources consulted.

GitHub's advisory GHSA-56cc-gxfr-hqp8 describes a critical SQL injection in the beanFeed.cfc component of Masa CMS, triggered through the sortDirection parameter. The record lists affected versions from 7.2.0 through 7.2.9, 7.3.0 through 7.3.14, 7.4.0 through 7.4.9 and 7.5.0 through 7.5.2, with fixes in 7.2.10, 7.3.15, 7.4.10 and 7.5.3. Upgrading to the fixed release of each branch is the primary remedy, and no confirmed exploitation appears in the sources consulted.

CVE-2026-7123 is an OS command injection flaw (CWE-77) in the CGI Handler component of the Totolink A8000RU, firmware 7.1cu.643_b20200521, reported as remotely exploitable. The CNA scores it CVSS 3.1 9.8 (critical), and the record states that a public exploit exists. The CISA KEV catalog does not list it, and no vendor fix is identified in the record.

A command injection weakness (CWE-77) has been reported in the setAdvancedInfoShow function of the CGI handler on Totolink A8000RU firmware 7.1cu.643_b20200521. The CNA, VulDB, rates it critical with a CVSS 3.1 base score of 9.8, states that it can be attacked remotely, and notes that a public exploit exists. The record shows no CISA KEV listing and no confirmed exploitation in the sources consulted.

CVE-2026-41924 is an OS command injection flaw in the makeRequest.cgi binary of the WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02). According to the record, it can be triggered without authentication through the set_time and StartSniffer functions, and VulnCheck scores it 9.3 under CVSS 4.0. The record shows no KEV listing, no affected version list and no fix, so remediation depends on the vendor.

Masa CMS contains an unauthenticated SQL injection in the JSON API altTable parameter, which is placed into a SQL FROM clause without validation. The record rates it critical with a CVSS 4.0 score of 9.3 from the GitHub CNA. Fixed versions are listed as 7.2.10, 7.3.15, 7.4.10 and 7.5.3, and the interim workaround is input validation or disabling the JSON API.

CVE-2026-8153 is an OS command injection flaw in the Dashboard Server interface of Universal Robots PolyScope, affecting versions prior to 5.25.1 as stated in the record. According to the record, an unauthenticated attacker could craft commands that execute code on the robot's operating system. The NVD status is Awaiting Analysis, and the CVSS 3.1 score of 9.8 was provided by the CNA.

The WDR201A WiFi Extender contains an OS command injection flaw in its firewall.cgi binary, classified as CWE-78 and scored 9.3 under CVSS 4.0 by the CNA. The record states that injected payloads persist in NVRAM and run again on later firewall.cgi requests. The record lists no fixed version and no CISA KEV entry.