Analysis

A flaw in the setPptpServerCfg function of the CGI Handler in Totolink A7100RU firmware 7.4cu.2313_b20191024 allows OS command injection through the enable argument, classified as CWE-77. The CNA rates it critical with a CVSS 3.1 base score of 9.8 and states the attack may be initiated remotely. The record says a public exploit has been disclosed, but the CVE is not listed in CISA KEV.

CVE-2026-5993 is a command injection flaw (CWE-77) in the setWiFiGuestCfg function of the CGI Handler in Totolink A7100RU firmware 7.4cu.2313_b20191024, triggered through the wifiOff argument and reachable remotely. The CNA vuldb assigned a CVSS 3.1 score of 9.8 and the record states a public exploit is available. The record does not list the CVE in CISA KEV and provides no affected or fixed version data.

CVE-2026-39399 affects NuGet Gallery, the software behind nuget.org, and is described as improper input validation in how the backend job handles .nuspec files, enabling metadata injection and arbitrary blob writes in storage. The record rates it critical with a CVSS v3.1 base score of 9.6 and states that it was patched in a specific commit. No confirmed exploitation appears in the sources consulted.

CVE-2026-20184 affects the single sign-on integration between Cisco Webex Services and Control Hub. The flaw stems from improper certificate validation and, according to the record, could let an unauthenticated remote attacker impersonate any user in the service. The record reports a CVSS 3.1 base score of 9.8 (critical) and no KEV listing, but it lists no affected or fixed versions.

CVE-2026-6131 is an OS command injection flaw (CWE-77) in the setTracerouteCfg function of the CGI Handler component of the Totolink A7100RU firmware 7.4cu.2313_b20191024, reachable through /cgi-bin/cstecgi.cgi. The CNA VulDB rates it 9.8 (critical) under CVSS 3.1 and states that it can be exploited remotely and that a public exploit exists. The CVE is not in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted.

CVE-2026-5851 is a command injection flaw in the setUPnPCfg function of the CGI Handler component of Totolink A7100RU firmware 7.4cu.2313_b20191024, reachable remotely through /cgi-bin/cstecgi.cgi. The CNA VulDB scores it 9.8 under CVSS 3.1, and the record states that an exploit has been published. The record lists no KEV entry and no confirmed exploitation in the sources consulted.

CVE-2026-25775 affects the remote management service of the SenseLive X3050, which allows firmware retrieval and update operations without authentication or authorization. CISA's ICS advisory rates it critical, with a CVSS 3.1 score of 9.8 and a CVSS 4.0 score of 9.3 from the same CNA. The sources consulted do not list affected or fixed versions, and no confirmed exploitation.

A vulnerability in the CGI Handler of Totolink A7100RU firmware 7.4cu.2313_b20191024 allows OS command injection through the setLoginPasswordCfg function, according to the CNA VulDB record. The record says it can be triggered remotely and gives a CVSS 3.1 base score of 9.8 (critical). A public exploit is mentioned, but the device is not listed in CISA KEV and no fixed version appears in the sources consulted.

CVE-2026-5059 is a critical OS command injection flaw (CWE-78) in aws-mcp-server, disclosed through the Zero Day Initiative. According to the record, a remote attacker without authentication could execute code in the context of the MCP server. The CNA published a CVSS 3.0 base score of 9.8, but the record lists no affected versions, fixes, or confirmed exploitation.

CVE-2026-6155 describes an OS command injection weakness (CWE-77) in the setWanCfg function of the CGI Handler on Totolink A7100RU 7.4cu.2313, triggered through the pppoeServiceName argument. The CNA scores it 9.8 (critical) under CVSS 3.1 and reports that the attack can be launched remotely. The record states that a public exploit exists, but the CVE is not listed in CISA KEV and no confirmed in-the-wild exploitation appears in the sources consulted.

CVE-2026-5977 is a critical OS command injection weakness (CWE-77) in the CGI Handler of the Totolink A7100RU, affecting version 7.4cu.2313_b20191024 as named in the record. The record states that manipulating the wifiOff argument of the setWiFiBasicCfg function can lead to command execution and that remote attacks are possible. An exploit is described as publicly available, but the record does not show KEV listing or confirmed exploitation in the wild.

CVE-2026-5426 describes a hard-coded ASP.NET/IIS machineKey in Digital Knowledge KnowledgeDeliver deployments prior to February 24, 2026. According to the record, this allows attackers to bypass ViewState validation and achieve remote code execution through malicious ViewState deserialization. The CVSS 3.1 base score of 9.1 is listed as critical, and no confirmed exploitation appears in the sources consulted.

CVE-2026-6264 is a critical flaw in Talend JobServer and Talend Runtime that, according to the record, allows unauthenticated remote code execution through the JMX monitoring port. The CNA-assigned CVSS 3.1 base score is 9.8, and the record describes mitigations including TLS client authentication on the monitoring port and disabling that port, while stating that the patch is required for full mitigation. No confirmed exploitation appears in the sources consulted, and the record does not list affected or fixed versions.

CVE-2026-6195 is a critical command injection weakness (CWE-77) reported in the setPasswordCfg function of the CGI handler on the Totolink A7100RU, version 7.4cu.2313_b20191024. The CNA rates it CVSS 3.1 9.8 and states that the attack can be carried out remotely and that a public exploit has been disclosed. The record does not list affected or fixed versions, and no confirmed exploitation in the wild appears in the sources consulted.

CVE-2026-1555 affects the WebStack theme for WordPress, where missing file type validation in the io_img_upload() function allows unauthenticated users to upload arbitrary files, per the record's description. The CNA Wordfence rates it critical with a CVSS 3.1 base score of 9.8, and the record notes that remote code execution may be possible. No confirmed exploitation appears in the sources consulted, and the record contains no fixed version.