Analysis

CVE-2026-42607 affects Grav, a file-based web platform, in versions before 2.0.0-beta.2. An authenticated administrator can upload a crafted ZIP archive through the Direct Install tool, because archive contents are not inspected, which can lead to remote code execution. The record reports CVSS 3.1 9.1 (critical) and a fix in 2.0.0-beta.2, and the flaw is not listed in CISA KEV.

In affected versions of the go-pkgz/auth library, the Patreon OAuth provider maps every authenticated Patreon account to the same local user ID. This can merge unrelated Patreon users into one identity, which may lead to cross-account access and subscription-state exposure in applications that rely on that ID. The CNA lists a CVSS 3.1 base score of 9.1, and the fixed versions are 1.25.2 and 2.1.2.

CVE-2026-7124 is a command injection flaw in the setIpv6LanCfg function of the CGI handler on Totolink A8000RU devices, reachable through the addrPrefixLen argument. The CNA VulDB describes it as remotely exploitable and reports that an exploit has been publicly disclosed. The CVSS 3.1 base score is 9.8 (critical), but no affected or fixed version ranges were provided in the record.

Plane, an open-source project management tool, prior to 1.4.0 accepts unverified email addresses from Gitea and self-managed GitLab OAuth logins, which can let an attacker match a victim's local account. The GitHub CNA scored it 9.1 (CVSS 3.1, critical) and the record lists CWE-287. The issue is fixed in 1.4.0, and no confirmed exploitation appears in the sources consulted.

Versions of NornicDB before 1.0.42-hotfix bind the Bolt listener to all network interfaces because the configured address never reaches the Bolt server configuration. On a local network, this can expose the graph database to any device sharing the network, and the description states that default admin:password credentials are in use. The record rates the issue critical with a CVSS 3.1 base score of 9.8 and states that it is fixed in 1.0.42-hotfix.

Zigbee EZSP host applications from Silicon Labs contain a buffer overflow caused by improper input validation, which can corrupt the stack. The record states that code execution is possible under certain conditions and that access to a network key is required. The CVSS 4.0 score in the record is 9.4, and the CVE is not listed in CISA KEV.

A vulnerability in the CGI Handler component of Totolink A8000RU firmware 7.1cu.643_b20200521 allows OS command injection through a manipulated argument, according to the CNA VulDB record. The record states that the attack can be executed remotely and that the exploit has been publicly disclosed. CISA KEV does not list this CVE, and the CNA reports a CVSS v3.1 base score of 9.8.

A vulnerability in the setUrlFilterRules function of the CGI Handler on Totolink A8000RU firmware 7.1cu.643_b20200521 allows OS command injection through the enable argument. The record describes it as remotely triggerable, rated critical with CVSS 3.1 score 9.8 by the CNA, and classified as CWE-77. The sources consulted report a public exploit but no confirmed exploitation in the wild, and no fixed version is listed.

CVE-2026-5166 is a path traversal weakness (CWE-22) in the Pardus Software Center developed by TUBITAK BILGEM, affecting versions before 0.6.4. The CNA-provided CVSS 3.1 base score is 9.6 (critical), and the record lists no fixed version. No confirmed exploitation appears in the sources consulted, and the CVE is not listed in CISA KEV.

CVE-2026-42454 affects Termix before version 2.1.0, where Docker container management endpoints place the containerId path parameter and a WebSocket message field into shell commands without validation. The weakness is classified as OS command injection (CWE-78) and carries a CVSS 3.1 base score of 9.9 according to the record. The advisory states it is fixed in version 2.1.0, and no confirmed exploitation appears in the sources consulted.

CVE-2025-10970 describes a blind SQL injection (CWE-89) in Talentics, a product from Kolay Software Inc. The CNA, USOM, assigned a CVSS 3.1 score of 9.8 (critical) with a network, low-complexity, no-privilege, no-interaction vector. The record lists no affected version entries, no fix, no KEV listing, and no vendor response.

FreeScout versions before 1.8.217 accept a user-setup invite hash that never expires, so a leaked invitation can be used months or years later to set a password. GitHub's CNA scored the issue 9.1 (critical, CVSS 3.1) and classified it as CWE-613. The record states the issue is patched in 1.8.217 and that it is not listed in CISA KEV.

CVE-2026-7411 is a path traversal flaw (CWE-22) in the Submodel HTTP API of Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10. According to the CNA, an unauthenticated remote attacker can abuse the fileName parameter during file upload to write files outside the intended storage area, which may lead to remote code execution. The record carries a CVSS 3.1 base score of 10 from the CNA, is not listed in CISA KEV, and lists no affected or fixed versions yet.

CVE-2026-7138 is an OS command injection issue (CWE-77) in the setNtpCfg function of the CGI handler on Totolink A8000RU firmware 7.1cu.643_b20200521. The CNA, VulDB, rates it critical with a CVSS 3.1 score of 9.8 and reports that remote exploitation is possible and that a public exploit exists. The record lists no structured affected or fixed versions and no confirmed active exploitation.

Masa CMS versions 7.5.2 and earlier contain an SQL injection flaw in the sortBy parameter processed by the getQuery function of beanFeed.cfc. According to the record, an unauthenticated remote attacker could run arbitrary SQL against the database. Fixes are reported in versions 7.2.10, 7.3.15, 7.4.10 and 7.5.3, and a WAF-based workaround is described.