Analysis

SAIL, a cross-platform image library, has an out-of-bounds write (CWE-787) in the RLE decoder of its TGA codec, where the raw-packet path lacks the bounds check used on the run-packet path. The CNA scores it 9.8 (Critical) under CVSS 3.1, and the record references commit 45d48d1f2e8e0d73e80bc1fd5310cb57f4547302 as the patch. The record contains no affected or fixed version list and no KEV listing.

ELBA5 version 5.8.0 is affected by a critical remote code execution issue (CVE-2018-25272) that, according to the record, can be reached through default database connector credentials. The description states that this may expose database credentials and allow commands with SYSTEM-level permissions. The record lists no fixed version, and CISA KEV does not list this CVE.

CVE-2026-22336 is an SQL injection weakness (CWE-89) in the Directorist Booking plugin for WordPress, which the record places in versions before 3.0.2. The CNA, Patchstack, assigns a CVSS 3.1 base score of 9.3 (critical). The record shows no CISA KEV listing and no confirmed exploitation in the sources consulted.

A command injection flaw has been reported in the setIpQosRules function of the CGI Handler on Totolink A7100RU firmware 7.4cu.2313_b20191024, triggered through the Comment argument. The CNA VulDB rates it critical with a CVSS 3.1 base score of 9.8 and states that remote exploitation is possible and that a public exploit exists. CISA KEV does not list it, and no confirmed active exploitation appears in the sources consulted.

CVE-2026-5854 is a critical OS command injection (CWE-77) in the setWiFiEasyCfg function of the CGI Handler component on Totolink A7100RU firmware 7.4cu.2313_b20191024. The CNA VulDB reports a CVSS 3.1 base score of 9.8 and says the issue can be triggered remotely, with a public exploit available. No confirmed exploitation in the wild appears in the consulted sources, and the record lists no affected or fixed versions.

Pachno 1.0.6 is reported to contain a deserialization flaw (CWE-502) in which cache files with predictable names and world-writable permissions can carry PHP object payloads that are unserialized during framework bootstrap, before authentication. The CVSS 3.1 base score of 9.8 is listed with network attack vector and no privileges or user interaction required. No confirmed exploitation appears in the sources consulted, and the record contains no affected or fixed version data.

Jellystat versions before 1.1.10 build several SQL queries by inserting unsanitized request-body fields, which allows SQL injection by an authenticated user. The advisory describes possible full read access to the database, including stored administrator and Jellyfin credentials, and escalation to command execution on the PostgreSQL host. Version 1.1.10 contains the fix, and no confirmed active exploitation appears in the sources consulted.

CVE-2026-7037 is a command injection flaw (CWE-77) in the setVpnPassCfg function of the CGI Handler on the Totolink A8000RU, firmware 7.1cu.643_b20200521. The CNA VulDB reports that it can be exploited remotely and that a public exploit has been released. No confirmed active exploitation appears in the sources consulted, and the record lists no affected or fixed versions.

Vvveb CMS 1.0.8.2 has a missing return statement in its media file rename handler, which lets authenticated users rename files to blocked extensions such as .php and .htaccess. The record reports CVSS 3.1 9.1 (critical) and CWE-434, unrestricted upload of a file with a dangerous type. The vulnerability is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

A command injection weakness (CWE-77) has been reported in the setRadvdCfg function of the Totolink A7100RU, version 7.4cu.2313_b20191024, reachable through the CGI handler at /cgi-bin/cstecgi.cgi. The record describes remote exploitation via the maxRtrAdvInterval argument and states that a public exploit exists. The CNA assigns a CVSS 3.1 base score of 9.8, and no fixed version is listed in the sources consulted.

CVE-2019-25714 affects Seeyon OA A8 and, as described in the record, lets an unauthenticated remote attacker write arbitrary files into the web application root through the /seeyon/htmlofficeservlet endpoint. The record classifies the flaw as CWE-434 and cites a CVSS 4.0 base score of 9.3 from VulnCheck, and notes that Shadowserver first observed exploitation evidence on 2021-03-26 (UTC). The record contains no affected version list, no fix information and no CISA KEV listing.

CVE-2026-39440 is a code injection vulnerability (CWE-94) in Funnelforms LLC FunnelFormsPro that allows remote code inclusion in versions described as from n/a through 3.8.1. The CNA Patchstack rates it critical with a CVSS 3.1 base score of 9.9. The record does not list a fixed version, and it is not in CISA's KEV catalog.

CVE-2026-22563 is a group of Improper Input Validation (CWE-20) weaknesses in UniFi Play PowerAmp and UniFi Play Audio Port that may allow command injection by an actor with access to the UniFi Play network. The record reports a CVSS 3.1 base score of 9.8 (critical) and gives fixed versions of 1.0.38 for PowerAmp and 1.1.9 for Audio Port. No KEV listing or confirmed exploitation appears in the sources consulted.

CVE-2026-5978 is a command injection flaw (CWE-77) in the setWiFiAclRules function of the CGI Handler on the Totolink A7100RU, as described by the CNA VulDB. The CNA assigns a CVSS 3.1 base score of 9.8 and the record states the attack can be initiated remotely. The record also says a public exploit has been disclosed, but no confirmed exploitation in the wild appears in the sources consulted.

CVE-2026-5975 is an OS command injection flaw in the setDmzCfg function of the CGI Handler on the Totolink A7100RU, firmware 7.4cu.2313_b20191024. The CNA rates it critical with a CVSS 3.1 score of 9.8, and the record states that a public exploit is available. The record does not list a fixed version and the CVE is not in CISA KEV.