Analysis

A vulnerability in the setPptpServerCfg function of /cgi-bin/cstecgi.cgi on Totolink A8000RU firmware 7.1cu.643_b20200521 allows OS command injection through the enable argument, and the record says it can be initiated remotely. VulDB rates it critical with a CVSS 3.1 score of 9.8, and the exploit has been publicly disclosed. The record shows no CISA KEV listing, and no confirmed exploitation appears in the sources consulted.

CVE-2026-42613 affects the Login plugin of the Grav file-based web platform. According to the record, Login::register() accepts groups and access values from registration POST data without server-side validation, which can let an unauthenticated user register with admin.super privileges when those fields are allowed. The record states the issue is fixed in 2.0.0-beta.2.

CVE-2026-41923 affects the WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) and is an OS command injection flaw (CWE-78) in the internet.cgi binary that the record says is reachable without authentication. VulnCheck assigns a CVSS 4.0 score of 9.3, and the record labels the severity critical. The sources consulted show no fixed version and no KEV listing, so affected devices should be treated as exposed until the vendor publishes guidance.

A command injection flaw in the CsteSystem function reached through /cgi-bin/cstecgi.cgi on Totolink A8000RU firmware 7.1cu.643_b20200521 can be triggered remotely, according to the CNA VulDB. The CNA rates it critical with a CVSS 3.1 score of 9.8, and the record states a public exploit exists. The record does not show a CISA KEV listing, confirmed exploitation, or a fixed version.

A critical command injection flaw (CVSS 3.1 base score 9.8) in some versions of Hikvision iSecure Center could let attackers gain platform privileges and run arbitrary commands. The product was released only for China's domestic market. No confirmed exploitation appears in the sources consulted, and the record lacks affected and fixed version details.

CVE-2026-41930 affects Vvveb versions before 1.0.8.2 and stems from hard-coded database credentials in the docker-compose-apache.yaml file that deploys a bundled phpMyAdmin container. The record describes unauthenticated access to the full Vvveb database, including administrator password hashes and customer and order data. The record rates it critical (CVSS 3.1 score 9.8) and shows it is not listed in the CISA KEV catalog.

CI4MS version 0.31.4.0 is affected by a stored DOM-based XSS in the filename field of the backup module, which the record says can lead to full account takeover and privilege escalation. The issue is reported as patched in version 0.31.5.0 and carries a CVSS 3.1 critical base score of 9.1. The record shows no CISA KEV listing and no confirmed exploitation in the sources consulted.

A command injection weakness (CWE-77) was reported in the setWiFiBasicCfg function of the CGI Handler component on Totolink A8000RU firmware 7.1cu.643_b20200521. The CNA VulDB scores it 9.8 under CVSS 3.1 and describes remote exploitation with a public exploit, but the record lists no fixed version and the device is not in CISA KEV.

CVE-2023-28814 is a critical improper file upload weakness (CWE-434) in some versions of Hikvision's iSecure Center product, as described by the CNA. Because uploaded files are not properly verified, an attacker may be able to place malicious files on the server. The sources consulted do not list affected or fixed versions, and the vulnerability is not in CISA's KEV catalog.

CVE-2026-42076 affects Evolver, a self-evolving engine for AI agents, in versions prior to 1.69.3. A command injection flaw in _extractLLM() can allow an attacker to run arbitrary shell commands on the server when the corpus parameter contains shell metacharacters. The record reports a CVSS 3.1 base score of 9.8 (critical) and states that version 1.69.3 contains the fix.

SEPPmail Secure Email Gateway versions before 15.0.4 contain a missing authorization weakness (CWE-862) across several endpoints of the new GINA UI. The CNA rates the issue critical with a CVSS 4.0 score of 9.3, and the record describes unauthenticated remote access to functions that should require a valid session. No CISA KEV listing appears in the consulted data.

CVE-2026-6795 is an open redirect weakness (CWE-601) in DivvyDrive, published on 2026-05-07 with a CNA-assigned CVSS 3.1 score of 9.6 (critical). The record states that versions from 4.8.2.9 before 4.8.3.2 are affected. No exploitation in the CISA KEV catalog or other consulted sources was found, and the record does not name a fixed version.

CVE-2026-22337 is an incorrect privilege assignment flaw (CWE-266) in the Directorist Social Login WordPress plugin that, according to the record, allows privilege escalation. The record lists a CVSS 3.1 base score of 9.8 from the CNA Patchstack and affected versions described as before 2.1.4. The CVE is not listed in CISA KEV in the record, and no confirmed active exploitation appears in the sources consulted.

CVE-2026-6132 is a command injection flaw (CWE-77) in the setLedCfg function of the CGI Handler component on the Totolink A7100RU, triggered through the enable argument. The CNA reports a CVSS 3.1 base score of 9.8 and states that remote exploitation is possible and a public exploit has been disclosed. The record does not list a fixed version, and this CVE is not in the CISA KEV catalog.

NewSoftOA, from NewSoft, has a critical OS command injection flaw (CWE-78) that the CNA TWCERT/CC describes as allowing unauthenticated attackers to run arbitrary commands on the server. The CVSS 3.1 base score is 9.8, and the record lists no affected or fixed versions. No confirmed exploitation appears in the sources consulted, and the CVE is not listed in CISA KEV.