Analysis

CVE-2026-44126 affects SEPPmail Secure Email Gateway before version 15.0.4 and is classified as insecure deserialization of untrusted data (CWE-502). According to the CNA, the flaw can be reached through the new GINA UI and may allow unauthenticated remote code execution, with a CVSS 4.0 base score of 9.2 (critical). No confirmed exploitation appears in the sources consulted, and the CVE is not listed in CISA KEV.

CVE-2025-49655 is a deserialization of untrusted data weakness (CWE-502) in the Keras framework. According to the record, a crafted Keras file containing a TorchModuleWrapper class can run arbitrary code when loaded, even with safe mode enabled. The CNA scores it CVSS 3.1 9.8 (Critical), and the record shows no KEV listing.

CVE-2026-7140 is an OS command injection vulnerability in the CsteSystem function of the CGI Handler component of Totolink A8000RU firmware 7.1cu.643_b20200521, as described by the CNA VulDB. The CNA rates it critical, with a CVSS 3.1 base score of 9.8 and a network attack vector. The record states that exploit details have been disclosed publicly, but CISA KEV does not list it and no confirmed exploitation appears in the sources consulted.

CVE-2026-7719 is a buffer overflow (CWE-119) in the loginauth function of the POST Request Handler component of Totolink WA300 firmware 5.2cu.7112_B20190227. The CNA rates it critical (CVSS 3.1 score 9.8) and states it can be triggered remotely, and that an exploit has been published. The record does not show KEV listing or confirmed exploitation in the wild.

A vulnerability in the CGI Handler component of the Totolink A8000RU, firmware 7.1cu.643_b20200521, allows OS command injection through a manipulated argument, classified as CWE-77. The CNA rates it critical with a CVSS 3.1 base score of 9.8, and the record states it can be started remotely and that a public exploit exists. No confirmed exploitation or vendor fix appears in the sources consulted.

CVE-2026-7242 is an OS command injection weakness (CWE-77) in the setOpenVpnClientCfg function of the CGI Handler reached through /cgi-bin/cstecgi.cgi on Totolink A8000RU firmware 7.1cu.643_b20200521. The CNA scores it critical, with CVSS 3.1 at 9.8, and the record states that a public exploit has been disclosed. The CISA KEV catalog does not list it, and the record contains no fixed version.

CVE-2026-42569 affects phpVMS versions prior to 7.0.6, where a critical flaw allowed unauthenticated access to a legacy import feature. The CNA-reported CVSS 3.1 base score is 9.4, and the issue is patched in 7.0.6. No confirmed exploitation appears in the sources consulted.

CVE-2026-7567 affects the Temporary Login plugin for WordPress in versions up to and including 1.0.0. The record describes an authentication bypass that can let an unauthenticated visitor sign in as a user with an active temporary login, with a CVSS 3.1 base score of 9.8. No fixed version is listed in the record, and no confirmed exploitation appears in the sources consulted.

Plane, an open-source project management tool, is affected by an insecure direct object reference in its bulk asset endpoint, as described in the record. The description says a workspace Guest can reassign assets from another project and obtain a presigned download URL, and that the issue is fixed in 1.4.0. GitHub rates it critical with a CVSS 3.1 score of 9.6, and no confirmed exploitation appears in the sources consulted.

CVE-2026-41922 is an OS command injection flaw (CWE-78) in the wireless.cgi binary of the WDR201A WiFi Extender, hardware V2.1 with firmware LFMZX28040922V1.02. The record states that an unauthenticated remote attacker could run arbitrary shell commands, and the CNA assigned a CVSS 4.0 score of 9.3. The record lists no affected or fixed versions and the vulnerability is not in CISA KEV.

Moxa network security appliances and routers contain an API authorization flaw (CWE-250) that lets an authenticated, low-privileged user create administrator accounts, including accounts with usernames identical to existing users. Moxa rates it 9.3 (critical) under CVSS 4.0, and the record shows no KEV listing or confirmed exploitation in the sources consulted. Check the Moxa advisory for affected versions and fixes, since the record does not provide them.

CVE-2025-6950 affects Moxa network security appliances and routers, which use a hard-coded secret key to sign JSON Web Tokens used for authentication. The CNA rated it critical with a CVSS 4.0 base score of 9.9, and an unauthenticated attacker could forge tokens to impersonate any user. The CVE is not listed in CISA KEV and no confirmed exploitation appears in the sources consulted.

A stack-based buffer overflow has been reported in the find_host_ip function of the lighttpd component in Totolink NR1800X 9.1.0u.6279_B20210910, triggered by manipulation of the Host argument. According to the CNA record, the attack can be carried out remotely and a public exploit has been disclosed. The sources consulted show no confirmed exploitation in the wild, and the CVE is not listed in CISA KEV.

CVE-2026-41202 affects ci4ms, a CodeIgniter-based CMS skeleton, in versions before 0.31.5.0. The backup restore routine extracts uploaded ZIP archives without validating entry names, a Zip Slip path traversal that lets an authenticated backend user with backup create permission write files outside the intended directory. The record describes this as potentially leading to remote code execution, and the issue is fixed in 0.31.5.0.

CVE-2026-7122 is an OS command injection vulnerability (CWE-77) in the setUPnPCfg function of the CGI Handler of the Totolink A8000RU firmware 7.1cu.643_b20200521. The CNA VulDB rates it 9.8 (Critical) under CVSS 3.1 and describes it as remotely reachable without privileges. The record states the exploit has been publicly disclosed, but no confirmed exploitation appears in the sources consulted and no fixed version is listed.