Analysis

Smart Slider 3 Pro version 3.5.1.35 for WordPress and Joomla is described as carrying a multi-stage remote access toolkit delivered through a compromised update system. The description says it enables unauthenticated code execution and persistence, and the record rates it critical with CVSS 3.1 score 9.8. No confirmed exploitation appears in the sources consulted, and the record lists no affected or fixed versions.

VulDB has published CVE-2026-6114, an OS command injection flaw in the setNetworkCfg function of /cgi-bin/cstecgi.cgi on the Totolink A7100RU, firmware 7.4cu.2313_b20191024. The record states the attack can be launched remotely and that a public exploit exists, and the CNA rates it critical with CVSS 3.1 score 9.8. No vendor fix or affected version range is listed in the sources consulted, so administrators should restrict exposure of the device's management interface now.

The XWD image codec in the SAIL library can write outside its allocated buffer because its byte-swap routine uses a pixel-depth field that disagrees with the format selected elsewhere. GitHub's CNA rates it critical with a CVSS 3.1 score of 9.8, and the record points to a patch commit. The record does not list it as exploited, and no confirmed exploitation appears in the sources consulted.

A command injection flaw (CWE-77) has been published for the Totolink A7100RU firmware 7.4cu.2313_b20191024, affecting the setTelnetCfg function of the CGI Handler component. VulDB, as CNA, rates it 9.8 (critical) under CVSS 3.1 and describes remote exploitation. The record states that a public exploit exists, but the CVE is not listed in CISA KEV and the record lists no fixed version.

V2Board 1.6.1 through 1.7.4 and Xboard through 0.1.9 return authentication tokens in HTTP response bodies of the loginWithMailLink endpoint when the login_with_mail_link_enable feature is active. The record indicates that an unauthenticated party who knows an email address could obtain a token that leads to full account access, including administrative privileges. No confirmed exploitation appears in the sources consulted, and the record lists no affected or fixed version ranges.

CVE-2026-34415 affects Xerte Online Toolkits 3.15 and earlier. A regular expression in the elFinder connector fails to block the .php4 extension, and the record links this to authentication bypass and path traversal issues that could allow command execution on the server. The record gives a CVSS 3.1 score of 9.8 (Critical) and is not listed in CISA KEV.

CVE-2026-6025 is an OS command injection flaw in the setSyslogCfg function of the CGI Handler component in Totolink A7100RU firmware 7.4cu.2313_b20191024. The record says that manipulating the enable argument leads to command injection, that the attack can be launched remotely, and that a public exploit is available. The CNA rates it critical with CVSS 3.1 score 9.8, but no fixed version appears in the sources consulted.

AWS Ops Wheel does not verify the signature of JSON Web Tokens, so an unauthenticated attacker could forge a token and obtain unintended administrative access. The record links this to API Gateway endpoints and notes possible cross-tenant data access and Cognito User Pool account management. The CVSS 3.1 base score is 9.8 (critical), and the sources consulted show no confirmed exploitation.

UniFi Play PowerAmp and UniFi Play Audio Port contain a path traversal flaw in device firmware, classified as CWE-22. The CNA assigned a CVSS 3.1 score of 9.8 (critical), and the description states that an actor with access to the UniFi Play network could write files that may enable remote code execution. The description gives fixed versions, but no confirmed exploitation appears in the sources consulted.

A command injection weakness (CWE-77) in the CGI handler of Totolink A7100RU firmware 7.4cu.2313_b20191024 can be triggered remotely through the lan_info argument. The CNA scores it CVSS 3.1 9.8 (critical), and the record states that a public exploit is available. The record shows no CISA KEV listing and no confirmed exploitation in the sources consulted.

The Create DB Tables plugin for WordPress lacks capability and nonce checks on its table creation and deletion actions, so any logged-in user, including Subscribers, can reach them. According to the record, this can allow arbitrary table creation and deletion, including core WordPress tables. The record lists a CVSS 3.1 score of 9.1 (critical), and no confirmed exploitation appears in the sources consulted.

mailcow: dockerized is affected by a stored cross-site scripting flaw in the Autodiscover logs shown in its admin dashboard, where the EMailAddress value is rendered without HTML escaping. According to the record, the payload can be submitted through an unauthenticated Autodiscover request and runs when an administrator views the logs. The record states that version 2026-03b fixes the issue, and the CNA rates it critical with a CVSS 4.0 score of 9.3.

Openfind's MailGates and MailAudit contain a stack-based buffer overflow (CWE-121) that, according to the record, may let unauthenticated remote attackers influence program execution flow and run arbitrary code. TWCERT assigned a CVSS 3.1 base score of 9.8 and a CVSS 4.0 score of 9.3. The record lists no affected versions, no fixed versions and no confirmed exploitation.

CVE-2026-5387 is a critical missing authorization weakness described in an ICS-CERT advisory, in which an unauthenticated attacker could perform operations reserved for Simulator Instructor or Simulator Developer (Administrator) roles. The record reports a CVSS 4.0 base score of 9.3 assigned by the CNA, but the affected product versions and fixes are not listed in the record. No confirmed exploitation is recorded in the sources consulted, and the CVE is not in CISA KEV.

ChurchCRM versions before 7.2.0 expose an API login endpoint that returns the user's API key after checking only username and password, skipping account lockout and two-factor authentication checks. The record describes this as an authentication bypass through an alternate path (CWE-288). The issue is fixed in version 7.2.0, and no confirmed exploitation appears in the sources consulted.