Analysis

The Piotnet Addons for Elementor Pro plugin for WordPress has an unrestricted file upload weakness (CWE-434) in its form builder, according to the record. The description states that all versions up to and including 7.1.70 are affected and that unauthenticated attackers may be able to upload files, which may enable remote code execution. Wordfence rates it 9.8 Critical under CVSS 3.1, and the sources consulted show no confirmed exploitation.

phpMyFAQ versions before 4.1.2 contain an improper restriction of excessive authentication attempts (CWE-307) in the /admin/check endpoint, according to the record. The description states that the endpoint lacks session binding and rate limiting, which could allow unauthenticated attackers to bypass two-factor authentication. The record shows a CVSS 3.1 base score of 9.1 and no confirmed active exploitation in the sources consulted.

The Avada Fusion Builder WordPress plugin, in versions up to and including 3.15.2, is affected by an unauthenticated remote code execution flaw classified as injection (CWE-74). Wordfence reports a CVSS 3.1 base score of 9.8 (critical), and the record lists no fixed version. The CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

The Totolink A8000RU firmware 7.1cu.643_b20200521 contains an OS command injection flaw in the setDdnsCfg function of its web management interface. The record describes remote exploitation, a publicly available exploit, and a critical severity rating.

CVE-2026-42774 is an SQL injection flaw (CWE-89) in Crocoblock JetEngine, with the record listing affected versions from n/a through 3.8.8.1. Patchstack, the CNA, assigns a CVSS 3.1 base score of 9.3 (critical), but the record contains no structured affected or fixed version data. The CVE is not in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

CVE-2026-33137 affects XWiki Platform. The POST /wikis/{wikiName} API runs a XAR import without authentication or authorization checks, so an unauthenticated attacker may create or update documents in the target wiki. The record shows a CVSS 4.0 score of 9.3 from GitHub Security Advisories, and the vendor's patched releases are 16.10.17, 17.4.9, 17.10.3, 18.0.1 and 18.1.0-rc-1.

Algernon versions before 1.17.7 search parent directories beyond the configured server root for a handler.lua file when a directory without an index is requested. The first match is loaded into the Lua interpreter with the full Algernon API, and the record describes this as reachable without authentication. The record states the issue is fixed in 1.17.7, and no confirmed exploitation appears in the sources consulted.

CVE-2026-42756 affects the QuickWebP image compression and WebP conversion plugin for WordPress in versions through 3.2.7, where a path traversal weakness (CWE-22) is reported. The record title describes the impact as arbitrary file deletion, and Patchstack rated it critical with a CVSS 3.1 score of 9.9. The record lists no fixed version, and no confirmed exploitation appears in the sources consulted.

CVE-2026-4320 is an authorization bypass in Creartia's ICMS software that can let an attacker reach protected features and escalate privileges without credentials by manipulating HTTP redirect behavior in the login process. INCIBE, the CNA, rates it critical with a CVSS 4.0 base score of 9.3. No KEV listing or confirmed exploitation appears in the sources consulted, and the record lists no affected or fixed versions.

CVE-2026-8467 is a critical code injection flaw (CWE-94) in Phenixdigital phoenix_storybook that allows unauthenticated remote code execution through unsanitized attribute values in HEEx template generation. The record reports CVSS 4.0 base score 9.5 from the CNA, affecting versions from 0.5.0 before 1.1.0, and a commit referenced as the fix. No confirmed exploitation in the wild appears in the sources consulted; upgrading to 1.1.0 or later is the primary remediation.

Crypt::OpenSSL::PKCS12 for Perl, in versions through 1.94, silently drops password bytes at or after an embedded NULL byte, so passwords lose entropy without any warning. The NVD record assigns CVSS 3.1 base score 9.8 (critical) and CWE-170. No KEV listing or confirmed exploitation appears in the sources consulted, and the record lists no affected or fixed versions.

CVE-2026-44449 affects Lumiverse before 0.9.7. When the primary path conversion fails, a fallback validates only the directory part, so unvalidated basename content can reach an smbclient script and be interpreted as commands. The CNA rates it critical with CVSS 3.1 score 9.1, and the sources consulted show no confirmed exploitation.

The Altium 365 SearchService exposes a legacy SOAP endpoint that performs search index operations without authentication, according to the CVE record. A remote unauthenticated attacker who knows a target workspace identifier could read or alter that workspace's search index across tenant boundaries. The CNA assigns a CVSS v4.0 base score of 10, and the record states that on-premise Altium Enterprise Server is not affected.

CVE-2026-44444 affects Lumiverse versions before 0.9.7. The Spindle extension build pipeline runs bun install without ignoring lifecycle scripts before the backend safety scan, so a malicious extension can execute code on the host when an administrator starts its install. The record rates it critical with CVSS 3.1 score 9.1, and no confirmed exploitation appears in the sources consulted.

Totolink A8000RU firmware 7.1cu.643_b20200521 has an OS command injection flaw (CWE-77) in its web management interface, which VulDB reports can be exploited remotely. The CNA rates it 9.8 under CVSS 3.1, and the description states that an exploit has been publicly released. The record lists no fixed version and the CVE is not in CISA KEV.