Analysis

NextGEN Gallery versions before 4.2.1 are affected by an authenticated SQL injection through the orderby parameter of two REST API endpoints. Tenable scores it 9.3 (critical) under CVSS v4.0, and the attacker needs a capability granted to Administrators by default. No confirmed exploitation appears in the sources consulted, and the CVE is not listed in CISA KEV.

CVE-2026-9264 is a cross-site scripting flaw in the Dynamic Components feature of Trimble SketchUp 2026, mapped to CWE-94 (Code Injection) in the record. The description reports impacts of remote code execution and local file exfiltration through crafted SKP files, and the CVSS 3.1 base score is 9.3. The record lists affected versions below 2026.1.3, provides no fix entries, and shows no CISA KEV listing.

The Boost plugin for WordPress, listed as PixelYourSite Boost, is affected by unauthenticated PHP Object Injection in versions up to and including 2.0.3 through unsafe deserialization of a cookie value. The sources consulted report no known POP chain in the plugin itself, so practical impact depends on other code installed on the same site. No fixed version is listed in the record, and the CVSS 3.1 score of 9.8 is reported by Wordfence.

A command injection flaw (CWE-77) has been reported in the setAccessDeviceCfg function of the Totolink A8000RU web management interface, through the mac argument. VulDB assigns a CVSS 3.1 base score of 9.8, and the record describes remote attack and a publicly released exploit. No fixed version is listed in the sources consulted, and this CVE is not in the CISA KEV catalog.

SureCart versions prior to 4.2.1 contain an authenticated SQL injection flaw in the REST API integrations endpoint, scored 9.3 (critical) under CVSS 4.0 by Tenable. The root cause is an escaping bypass in the query builder that can allow SQL to be injected into WHERE clauses. No confirmed exploitation appears in the sources consulted, and the record lists no fixed version.

CVE-2026-8838 affects amazon-redshift-python-driver before 2.1.14. The vector_in() function applies Python's eval() to data received from a server, which the record says could let a rogue server or man-in-the-middle actor run arbitrary code on the client. The CNA-provided CVSS 3.1 base score is 9.8 (critical), and the record advises upgrading to 2.1.14.

CVE-2026-9435 is a command injection flaw (CWE-77) reported in the Web Management Interface of the Totolink A8000RU, firmware 7.1cu.643_b20200521. The record states that manipulating the enable argument of the setQosCfg function can lead to OS command injection, that remote exploitation is possible, and that a public exploit exists. No fixed version or affected version range is given in the record, and the CVE is not listed in CISA KEV.

Typebot versions 3.15.2 and earlier allow unauthenticated Server-Side Request Forgery through the preview chat endpoint, because a fetch function inside the isolated-vm sandbox skips the URL validation used by the HTTP Request block. The record assigns a CVSS 3.1 score of 10.0 (Critical) and states that the issue is fixed in 3.16.0. The CISA KEV catalog does not list it, and no confirmed exploitation appears in the sources consulted.

CVE-2026-42731 is a privilege escalation flaw classified as CWE-266 (Incorrect Privilege Assignment) in the miniOrange OTP verification plugin, affecting versions through 5.4.9 according to the record. The CNA assessment rates it critical with a CVSS 3.1 score of 9.8 and no privileges or user interaction required. The record provides no fixed version, and no confirmed exploitation appears in the sources consulted.

CVE-2026-46725 is a critical deserialization flaw (CWE-502) in a TYPO3 extension, where an attacker-controlled cookie is passed to PHP's unserialize() without safe processing. The CNA's CVSS 4.0 score is 9.2, and the record states that exploitation requires the content element to use "Persistent Mode: Static". The record shows no confirmed exploitation in the sources consulted and no CISA KEV listing.

Versions of XWiki Platform before 18.1.0-rc-1, 17.10.3, 17.4.9 and 16.10.17 contain a path traversal weakness (CWE-23) that can expose configuration files through the ssx and jsx endpoints. The GitHub CNA scored it 9.3 (critical) under CVSS 4.0, and the record lists the issue as patched in the versions named above. The record does not list the vulnerability in CISA KEV, and no confirmed exploitation appears in the sources consulted.

CVE-2026-9458 is an OS command injection flaw in the setWanCfg function of the Web Management Interface of Totolink A8000RU firmware 7.1cu.643_b20200521, reachable remotely. VulDB and its CNA assign a CVSS 3.1 base score of 9.8 (critical), and the record notes that a public exploit is available. No fixed version is listed in the record, and the vulnerability is not in CISA KEV.

WP Super Edit for WordPress, versions 2.5.4 and earlier, contains an unrestricted file upload weakness in its FCKeditor component (CWE-434). The record links it to possible remote code execution, with a VulnCheck CVSS 3.1 base score of 9.8. No CISA KEV listing or confirmed exploitation appears in the sources consulted, and no fixed version is recorded.

A weakness in the Web Management Interface of Totolink A8000RU firmware 7.1cu.643_b20200521 allows OS command injection through the setScheduleCfg function in /cgi-bin/cstecgi.cgi. VulDB rates it critical with CVSS 3.1 score 9.8 and describes remote attack. The record states a public exploit exists, but the CVE is not in CISA KEV and no fixed version is listed.

CVE-2026-42727 is an SQL injection flaw (CWE-89) in the Active Products Tables for WooCommerce WordPress plugin by RealMag777, affecting versions up to and including 1.0.8. The record describes it as blind SQL injection and assigns a CVSS 3.1 base score of 9.3 (Critical) from Patchstack. No fixed version is listed and no confirmed exploitation appears in the sources consulted.