Analysis

SAP has published CVE-2026-27681, which affects SAP Business Planning and Consolidation and SAP Business Warehouse. Insufficient authorization checks allow an authenticated user to run crafted SQL statements that can read, modify, and delete database data. The record rates the issue critical with a CVSS v3.1 base score of 9.9 and maps it to CWE-89, but it lists no affected or fixed versions, so the SAP references should be consulted directly.

CVE-2026-42363 affects the Device Authentication functionality of GeoVision GV-IP Device Utility 9.0.5. According to the record, device credentials sent in certain UDP broadcast packets are protected by a weak, Blowfish-derived scheme whose key is included in the same packet, so an attacker on the same LAN may recover them. The record gives a CVSS 3.1 score of 9.3, but no affected or fixed versions and no confirmed exploitation were found in the sources consulted.

CVE-2026-40258 is a path traversal (Zip Slip) weakness in the media archive import feature of the Gramps Web API, affecting versions 1.6.0 through 3.11.0. According to the record, an authenticated user with owner-level privileges could use a crafted ZIP file to write files outside the temporary extraction directory. The description states that version 3.11.1 validates entry paths against the resolved temporary directory and aborts the import when an entry falls outside it.

FreeScout versions before 1.8.213 let an authenticated administrator overwrite protected mailbox fields through the connection settings save handlers, a mass assignment flaw classified as improper access control. The record rates it Critical with a CVSS 3.1 base score of 9.0 and states that version 1.8.213 fixes it. No confirmed exploitation appears in the sources consulted.

CVE-2026-41197 affects the Noir language toolchain when Brillig bytecode is generated for foreign calls that return nested arrays of composite element types such as tuples. The memory allocation for nested arrays uses the logical element count instead of the semi-flattened slot count, so the heap is under-allocated and can be corrupted. The GitHub advisory records a CVSS 4.0 score of 9.3 and states that version 1.0.0-beta.19 fixes the issue.

CVE-2026-40959 is a critical vulnerability in Luanti 5 before 5.15.2 when LuaJIT is used, allowing a Lua sandbox escape through a crafted mod. The record scores it 9.3 under CVSS 3.1 with a local attack vector and no privileges or user interaction required. No confirmed exploitation appears in the sources consulted, and the structured affected and fixed version data is still empty.

Breeze Cache for WordPress, in versions up to and including 2.4.4, has an unauthenticated arbitrary file upload flaw in the fetch_gravatar_from_remote function. The record assigns a CVSS 3.1 base score of 9.8 and states that exploitation requires the local Gravatar hosting option, which is disabled by default. No fixed version is listed in the record, and the CVE is not in CISA KEV.

Wordfence reports that all Essentialplugin plugins for WordPress contain an injected backdoor, reportedly added after the plugin was sold to a malicious actor. The backdoor is described as enabling persistent access and spam injection. The record assigns a CVSS 3.1 score of 9.8 and lists no confirmed active exploitation in the sources consulted.

CVE-2026-6115 is a command injection flaw in the setAppCfg function of /cgi-bin/cstecgi.cgi on the Totolink A7100RU, reported in firmware 7.4cu.2313_b20191024. The record states that manipulating the enable argument can lead to OS command injection, that the attack may be launched remotely, and that a published exploit exists. The CNA CVSS 3.1 base score is 9.8 (critical), but no KEV listing or confirmed exploitation was found in the sources consulted.

ChurchCRM versions before 7.2.0 copy files from the Images/ directory of an uploaded backup archive into the web-accessible document root without extension filtering. According to the record, an authenticated administrator can use this to place a PHP webshell that leads to remote code execution as the web server user, and the restore endpoint also lacks CSRF validation. The issue is fixed in version 7.2.0, and the record shows no CISA KEV listing.

A command injection weakness (CWE-77) has been reported in the setIptvCfg function of the CGI Handler on Totolink A7100RU firmware 7.4cu.2313_b20191024. According to the CNA, the igmpVer argument can be manipulated remotely to run operating system commands, and the record states that an exploit has been made public. The CNA rates it CVSS 3.1 9.8 (critical), and CISA KEV does not list it.

Hot Chocolate, an open-source GraphQL server for .NET, has a parser without a recursion depth limit, so deeply nested GraphQL documents can overflow the stack and terminate the worker process. The record assigns a CVSS score of 9.1 and describes fixes in the 12.22.7, 13.9.16, 14.3.1 and 15.1.14 releases. No confirmed exploitation appears in the sources consulted.

A reflected cross-site scripting weakness (CWE-79) affects Rukovoditel CRM 3.6.4 and earlier in the Zadarma telephony API endpoint. The record states that the 'zd_echo' GET parameter is returned to the HTTP response without adequate sanitization, output encoding, or content-type restrictions. The CNA rates the issue critical with a CVSS 3.1 score of 9.3, and no confirmed exploitation appears in the sources consulted.

CVE-2026-5853 is an OS command injection flaw (CWE-77) in the setIpv6LanCfg function of the CGI Handler on the Totolink A7100RU, firmware 7.4cu.2313_b20191024. The CNA rates it critical, with a CVSS 3.1 score of 9.8 and a network attack vector requiring no privileges or user interaction. The record states that an exploit has been publicly disclosed, but the CISA KEV catalog does not list it and no confirmed exploitation appears in the sources consulted.

Pachno 1.0.6 contains an XML external entity injection flaw in its TextParser helper that the record says can be reached without authentication. The record describes arbitrary file read as the impact, with a CVSS 3.1 base score of 9.8 (critical). No confirmed exploitation appears in the sources consulted and the CVE is not listed in CISA KEV.