Analysis

CVE-2026-7125 is an OS command injection weakness (CWE-77) in the CGI Handler of the Totolink A8000RU, firmware 7.1cu.643_b20200521. The CNA rates it critical with CVSS 3.1 9.8 and states that the attack may be initiated remotely. The record says a public exploit is available, but CISA KEV does not list the CVE and no confirmed exploitation appears in the sources consulted.

CVE-2026-29200 is a critical insecure direct object reference (IDOR) flaw in WebPros Comet Backup, with a CVSS v4.0 base score of 9.9 listed in the record. According to the record, a tenant administrator can impersonate end-user accounts of other tenants on the same server through a vulnerable API call. The sources consulted show no KEV listing and no confirmed active exploitation.

CVE-2023-54342 affects Eclipse Equinox OSGi versions 3.8 through 3.18 and is described as an unauthenticated remote code execution flaw in the console interface (CWE-306). The CVSS 3.1 base score is 9.8 (critical), as published by VulnCheck. The record shows no CISA KEV listing, and no confirmed exploitation appears in the sources consulted.

CVE-2026-42287 is a critical SQL injection flaw in Emlog's article creation and update functions, affecting versions prior to 2.6.11. The CNA-supplied CVSS 4.0 score is 10.0, and the record states the issue is patched in 2.6.11. The record does not list KEV status or confirmed exploitation.

A command injection flaw (CWE-77) has been reported in the setAppFilterCfg function of Totolink A8000RU firmware 7.1cu.643_b20200521, reachable through /cgi-bin/cstecgi.cgi. The CNA rates it critical with a CVSS 3.1 base score of 9.8 and states it can be exploited remotely. A public exploit is stated to exist, but the sources consulted show no confirmed exploitation in the wild.

CVE-2026-42302 affects the agent-sandbox component of FastGPT, where a startup script runs code-server without authentication on all network interfaces. According to the record, any user with network access to port 8080 can gain full control of the sandbox, and GitHub scores it 9.8 (critical). The issue is fixed in version 4.14.13.

The MStore API plugin for WordPress, version 2.0.6, is described as allowing unauthenticated users to upload arbitrary files through a REST API endpoint. According to the record, uploaded PHP files could lead to remote code execution, and VulnCheck assigns a CVSS 3.1 base score of 9.8 (critical). The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted.

A command injection flaw (CWE-77) has been reported in the setWiFiEasyGuestCfg function of the CGI handler on Totolink A8000RU firmware 7.1cu.643_b20200521. According to the record, manipulation of the merge argument can lead to operating system command execution, and the attack can be launched remotely. The description states a public exploit exists, but the record does not show KEV listing or confirmed exploitation.

JS8Call through 2.3.1 and JS8Call-improved before 3.0 contain a stack-based buffer overflow in the grid2deg routine of APRSISClient.cpp, triggered by a radio transmission containing an @APRSIS GRID message followed by an overlong Maidenhead locator. The CNA-provided CVSS 4.0 base score is 10, with a network attack vector and no privileges or user interaction required. No confirmed exploitation in the wild appears in the sources consulted, although SSVC records the exploitation state as poc.

A command injection vulnerability (CWE-77) has been reported in the setLoginPasswordCfg function of the CGI Handler component of Totolink A8000RU firmware 7.1cu.643_b20200521, reachable through /cgi-bin/cstecgi.cgi. According to the record, manipulation of the admpass argument can lead to operating system command injection, and the attack may be initiated remotely. The CNA assigned a CVSS 3.1 base score of 9.8 (critical), and no confirmed exploitation in the wild appears in the sources consulted.

A command injection flaw in the cstecgi.cgi CGI Handler of Totolink A8000RU 7.1cu.643_b20200521 is reported as remotely triggerable through the proto argument. The CNA (VulDB) scores it 9.8 under CVSS 3.1, and the record states that a public exploit is available. No KEV listing or confirmed exploitation appears in the sources consulted.

CVE-2026-41925 describes an OS command injection flaw (CWE-78) in the adm.cgi binary of the WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02), reachable without authentication. The CNA assigned a CVSS 4.0 base score of 9.3, but the record lists no affected or fixed versions, and the CISA KEV catalog does not list it. Operators should restrict access to the device's administration interface and check for vendor updates.

CVE-2026-5294 affects the GeekyBot plugin for WordPress up to and including 1.2.2 and is classified as Missing Authorization (CWE-862). According to the record, an unauthenticated request path can reach a plugin installer helper, which may allow arbitrary plugin installation and remote code execution, with a CVSS 3.1 base score of 9.8 (Critical). No confirmed exploitation appears in the sources consulted, and the record lists no fixed version.

Plunk versions before 0.9.0 accept Amazon SNS notification payloads at the /webhooks/sns endpoint without verifying the SNS signature, certificate, or topic ARN. The advisory describes this as allowing unauthenticated spoofing of SNS events, which can affect workflows, contacts, delivery metrics, and billing. The issue is fixed in version 0.9.0, and no confirmed exploitation appears in the sources consulted.

A vulnerability in the setWiFiWpsStart function of the CGI Handler component in Totolink A8000RU firmware 7.1cu.643_b20200521 allows OS command injection through the wscDisabled argument, according to the record. The CNA rates it critical with a CVSS 3.1 base score of 9.8, and the record states the attack can be initiated remotely. The record also states that the exploit has been publicly disclosed, but the CISA KEV catalog does not list this CVE.