Analysis

CVE-2026-3461 affects the Visa Acceptance Solutions plugin for WordPress in all versions up to and including 2.1.0. According to the record, guest checkout for subscription products can log a user in based only on a billing email address, allowing an unauthenticated party to take over existing accounts, including administrators. The record lists a CVSS 3.1 base score of 9.8 (critical), no fixed version, and no confirmed exploitation in the sources consulted.

Vvveb versions before 1.0.8.1 contain a code injection flaw in the installation endpoint, where the subdir POST parameter is written into the env.php configuration file without escaping or validation. The record describes this as enabling unauthenticated remote code execution with the web server user's privileges, and it is rated critical with CVSS 3.1 9.8. No confirmed exploitation appears in the sources consulted.

A command injection flaw (CWE-77) was reported in the setAdvancedInfoShow function of the CGI Handler on Totolink A7100RU firmware 7.4cu.2313_b20191024, through the tty_server argument. The CNA VulDB rates it critical with CVSS 3.1 score 9.8 and describes remote attack potential. The record states the exploit was publicly disclosed, but the CVE is not listed in CISA KEV and no fixed version appears in the sources consulted.

A command injection flaw (CWE-77) in the setAccessDeviceCfg function of the Totolink A7100RU CGI Handler can be triggered remotely through the mac argument. The CNA VulDB rates it CVSS 3.1 9.8 (Critical) and states that a public exploit has been published. The record shows no CISA KEV listing and no confirmed active exploitation in the sources consulted.

CVE-2026-39920 affects BridgeHead FileStore versions prior to 24A, where the Apache Axis2 administration module is reachable over the network with default credentials. According to the record, unauthenticated remote attackers could execute arbitrary operating system commands. The CVSS 3.1 base score is 9.8 (critical), and no confirmed exploitation appears in the sources consulted.

A command injection flaw in the setWizardCfg function of the CGI Handler in Totolink A7100RU firmware 7.4cu.2313_b20191024 can be triggered remotely, according to the record. The CNA VulDB rates it critical with a CVSS 3.1 score of 9.8, and the record states that a public exploit has been released. CISA KEV does not list this CVE, and the record contains no fixed version.

A flaw in ArgoCD Image Updater lets a user who can create or modify an ImageUpdater resource cross namespace boundaries in multi-tenant clusters. The record describes unauthorized image updates on applications owned by other tenants, leading to cross-namespace privilege escalation. The CNA rates it critical with CVSS 3.1 base score 9.1, while the record lists no fixed version and no confirmed exploitation appears in the sources consulted.

The Sendmachine for WordPress plugin, in all versions up to and including 1.0.20, does not properly verify user authorization in its manage_admin_requests function, classified as CWE-862. According to the record, an unauthenticated attacker could overwrite the plugin's SMTP configuration and intercept outbound site email, including password reset messages. The CVSS 3.1 base score is 9.8 (critical), and no confirmed exploitation appears in the sources consulted.

FreeScout versions before 1.8.215 extract ZIP archives during module installation without validating file paths, which is a Zip Slip path traversal (CWE-22). According to the record, an authenticated administrator could use a crafted archive to write files anywhere on the server filesystem, a condition the advisory associates with remote code execution. Version 1.8.215 is reported to fix the issue.

A vulnerability in the setDiagnosisCfg function of the CGI Handler in Totolink A7100RU firmware 7.4cu.2313_b20191024 allows OS command injection through the ip argument, according to the VulDB CNA record. The CNA rates it critical with CVSS v3.1 score 9.8, notes that remote exploitation is possible, and states that an exploit has been publicly disclosed. The CVE is not listed in CISA KEV and the record shows no fixed version.

CVE-2026-6029 is an OS command injection flaw in the setVpnAccountCfg function of the CGI handler on Totolink A7100RU version 7.4cu.2313_b20191024, reachable remotely through the User argument. VulDB scores it 9.8 (critical) under CVSS 3.1, and the record links a public exploit reference, but the consulted data does not show KEV listing or confirmed exploitation in the wild. No fixed version is listed in the sources, so owners should confirm patch status with the vendor.

CVE-2026-6140 is a command injection weakness (CWE-77) in the UploadFirmwareFile function of the CGI Handler on Totolink A7100RU 7.4cu.2313_b20191024, reachable remotely through the FileName argument. The record gives a CNA-provided CVSS 3.1 base score of 9.8 (critical) and states that a public exploit exists. CISA KEV does not list it, and no confirmed exploitation appears in the sources consulted.

Creolabs Gravity before 0.9.6 contains a heap-based buffer overflow in gravity_vm_exec that can be triggered by crafted script content. The record reports a CVSS 3.1 base score of 9.8 (critical) and describes possible code execution in applications that evaluate untrusted scripts. No confirmed exploitation appears in the sources consulted, and the CVE is not listed in CISA KEV.

A command injection flaw in the UploadOpenVpnCert function of the CGI Handler on the Totolink A7100RU, firmware 7.4cu.2313_b20191024, allows a manipulated FileName argument to run operating system commands remotely. The CNA VulDB rates it critical with a CVSS 3.1 base score of 9.8, and the record states the exploit has been publicly disclosed. CISA KEV does not list this CVE, and no confirmed exploitation appears in the sources consulted.

CVE-2026-22564 is an Improper Access Control weakness (CWE-284) in UniFi Play PowerAmp and UniFi Play Audio Port. According to the record, a malicious actor with access to the UniFi Play network could enable SSH and make unauthorized changes to the system. The record lists fixed versions for both products, and no confirmed exploitation appears in the sources consulted.