Analysis

CVE-2026-32644 affects specific firmware versions of Milesight AIOT cameras, which use SSL certificates whose private keys are default values. CISA's ICS-CERT, the CNA, rates the issue critical with a CVSS 3.1 score of 9.8. The record does not list affected or fixed versions, and no confirmed exploitation appears in the sources consulted.

CVE-2021-47940 affects the Download From Files plugin for WordPress, version 1.48 and earlier, and allows unauthenticated users to upload arbitrary files according to the record description. The CNA VulnCheck assigns a score of 9.8 under CVSS 3.1 and 9.3 under CVSS 4.0, and the record classifies the issue as CWE-306. CISA KEV does not list it, and no confirmed active exploitation appears in the sources consulted.

CVE-2026-7136 is a command injection weakness (CWE-77) in the setDmzCfg function of the CGI Handler on Totolink A8000RU firmware 7.1cu.643_b20200521. According to the record, manipulating the wanIdx argument can lead to OS command injection, and the attack may be launched remotely. VulDB, as CNA, scores it 9.8 under CVSS 3.1, and the record states that a public exploit is available, although the CVE is not listed in CISA KEV.

CVE-2026-5722 affects the MoreConvert Pro plugin for WordPress in all versions up to and including 1.9.14. The guest waitlist verification flow does not invalidate or regenerate tokens when the customer email changes, which the CNA describes as enabling unauthenticated authentication as existing users, including administrators. No confirmed exploitation appears in the sources consulted, and no fixed version is stated in the available record.

CVE-2026-7834 is a stack-based buffer overflow in the get_csrf_whites function of /cgi/advanced/misc_main.cgi in EFM ipTIME NAS1dual 1.5.24, as described by the CNA VulDB. The CNA rates it CVSS 3.1 9.8 (Critical) and states that it can be triggered remotely and that a public exploit has been disclosed. No confirmed exploitation in the wild appears in the sources consulted, and the record lists no affected version ranges or fixes.

CVE-2026-41203 affects CI4MS before 0.31.5.0. The Theme::upload function extracts uploaded ZIP archives without validating entry names, so an authenticated backend user with theme creation permission could write files outside the intended directory, including under the public web root. The issue is fixed in 0.31.5.0.

CVE-2026-41446 affects Snap One WattBox 800 and 820 series firmware prior to 2.10.0.0. Undisclosed diagnostic HTTP endpoints accept the device MAC address and service tag as authentication, and both values are printed on the device label. The record reports a CVSS 3.1 score of 9.8 (critical) and describes arbitrary command execution as root.

CVE-2026-44128 affects SEPPmail Secure Email Gateway versions before 15.0.2.1 and is rated critical by the CNA, with a CVSS 4.0 base score of 9.3. An endpoint in the new GINA UI passes attacker-controlled input to Perl's eval, which the record describes as allowing unauthenticated remote code execution. No confirmed exploitation appears in the sources consulted, and the record contains no structured affected or fixed product entries.

CVE-2021-47932 is a critical missing-authorization flaw in TheCartPress for WordPress, affecting versions up to and including 1.5.3.6. According to the record, an unauthenticated attacker can create administrator accounts through the plugin's AJAX handler. No fixed version is listed in the sources consulted, and the vulnerability is not in CISA KEV.

CVE-2026-42160 affects the backend of Data Space Portal, an open-source SaaS solution for dataspace management, in versions from 2.1.1 before 7.3.2. Authorization is insufficient for organization and user accounts that were self-registered and remain in a PENDING state. The vendor fixed the issue in version 7.3.2, and the GitHub CNA scored it 10 under CVSS 4.0.

CVE-2026-7152 is a command injection vulnerability (CWE-77) in the setTelnetCfg function of the CGI Handler component of Totolink A8000RU firmware 7.1cu.643_b20200521, reachable through /cgi-bin/cstecgi.cgi. The record describes it as remotely exploitable, with a publicly available exploit, and the CNA scores it 9.8 under CVSS 3.1. The record does not list affected or fixed versions, and it is not listed in CISA KEV.

CVE-2026-41070 is an improper authentication flaw in openvpn-auth-oauth2 affecting versions from 1.26.3 up to, but not including, 1.27.3, only when the component runs in the experimental plugin mode. Clients without WebAuth/SSO support can be admitted to the VPN even when the authentication logic denies them. The CVSS 3.1 score of 10.0 comes from the GitHub CNA, and the record states the issue is fixed in 1.27.3.

CVE-2026-42571 is a critical privilege escalation flaw (CWE-863, Incorrect Authorization) in the Web User Interface of Pelican, a platform for creating data federations. According to the record, any user authenticated to the WebUI via OAuth can gain admin privileges under certain configurations. The issue is patched in 7.21.5, 7.22.3, 7.23.3 and 7.24.2, and no confirmed exploitation appears in the sources consulted.

Note Mark versions described as affected fall back to a fixed placeholder when comparing passwords for accounts without a stored password, including accounts created through OIDC. According to the record, this lets an unauthenticated party obtain a valid session without user interaction, and the GitHub-sourced CVSS score is 9.4. The record states the issue is fixed in version 0.19.3.

CVE-2026-8076 affects the web administration panel of CashDro 3, version 24.01.00.26, which accepts numeric PINs for user authentication. The record describes the lack of account lockout as allowing brute-force guessing of PINs, with possible access to confidential configuration settings. The CNA rated it critical with CVSS 4.0 score 9.3, and no confirmed exploitation appears in the sources consulted.