Analysis

A command injection weakness (CWE-77) in the setUrlFilterRules function of the CGI handler on the Totolink A7100RU, version 7.4cu.2313_b20191024, can be triggered remotely through the enable argument. VulDB rates it Critical with CVSS 3.1 score 9.8 and states that a public exploit is available. The record lists no fixed version, and the CVE is not in CISA KEV.

CVE-2026-3596 is a missing authorization flaw (CWE-862) in the Riaxe Product Customizer WordPress plugin, affecting versions up to and including 2.1.2. According to the record, an unauthenticated AJAX action can update arbitrary WordPress options, which could be used to escalate privileges. The CNA rates it CVSS 3.1 9.8 (Critical), and no fixed version is listed in the sources consulted.

FalkorDB Browser 1.9.3 is reported to contain an unauthenticated path traversal flaw in its file upload API, which the record says lets remote attackers write arbitrary files and achieve remote code execution. The recorded CVSS 3.1 base score is 9.8 (Critical). No confirmed exploitation appears in the sources consulted, and the record lists no affected version ranges or fixes.

The oma package manager for AOSC OS, in versions before 1.25.2, does not check the name field of Topic Manifests that oma-topics fetches from remote mirrors. A malformed manifest can therefore lead to malicious APT source entries being written to atm.list. The issue is fixed in 1.25.2 and carries a CVSS 3.1 base score of 9.1, while no confirmed exploitation appears in the sources consulted.

Vendure Core contains an unauthenticated SQL injection in the Shop API, rated Critical with a CVSS 3.1 score of 9.1 by the GitHub CNA. The record lists affected ranges from 1.7.4 before 2.3.4, from 3.0.0 before 3.5.7, and from 3.6.0 before 3.6.2, and upgrading to patched releases is the primary remedy. No confirmed exploitation appears in the sources consulted.

CrowdStrike disclosed CVE-2026-40050, a critical unauthenticated path traversal flaw in LogScale that could let a remote attacker read arbitrary files from the server when a specific cluster API endpoint is exposed. According to the vendor, Next-Gen SIEM customers are not affected, SaaS clusters received network-layer blocks, and self-hosted customers should upgrade to a patched version. The record does not list affected or fixed version ranges.

Intrado 911 Emergency Gateway (EGW) versions 5.x, 6.x and 7.x contain a path traversal weakness in the download_debuglog_file.php endpoint. According to the record, an unauthenticated attacker could read files outside the intended directory, and ICS-CERT rates it critical with a CVSS 3.1 score of 9.8. No fixed versions or affected version details are listed in the sources consulted.

CVE-2026-4880 affects the Barcode Scanner (+Mobile App) WordPress plugin in versions up to and including 1.11.0. The record describes an unauthenticated flaw, classified as CWE-269, that can lead to administrator-level access, with a CVSS 3.1 base score of 9.8 assigned by Wordfence. No confirmed exploitation appears in the sources consulted, and the record lists no fixed version.

CVE-2026-5752 is a sandbox escape in Terrarium that, according to the published CVE description, allows arbitrary code execution with root privileges on a host process through JavaScript prototype chain traversal. The CVSS 3.1 base score reported by the CNA is 9.3 (critical), and the record is still in Awaiting Analysis status. No affected or fixed versions are listed in the sources consulted, so defenders should verify vendor guidance directly.

CVE-2026-6284 affects Horner Automation Cscape and the XL4 and XL7 PLCs, where limited password complexity and the absence of password input limits make brute force password discovery possible for an attacker with network access to the device. The CNA (ICS-CERT) rated it CVSS 3.1 9.1 and CVSS 4.0 9.3. No confirmed exploitation appears in the sources consulted, and the record shows it is not listed in CISA KEV.

A flaw in the setStorageCfg function of the CGI Handler in Totolink A7100RU firmware 7.4cu.2313_b20191024 allows OS command injection through the sambaEnabled argument. The record reports remote reachability and a publicly released exploit, and the CNA scores it 9.8 under CVSS 3.1. The record is not listed in CISA KEV, and it provides no fixed version.

A command injection flaw (CWE-77) has been reported in the CGI Handler of the Totolink A7100RU, firmware 7.4cu.2313_b20191024, within the setTtyServiceCfg function. The CNA VulDB rates it 9.8 under CVSS 3.1 and describes remote exploitation, with an exploit disclosed publicly. The record does not show a KEV listing or an official fixed version.

CVE-2026-23751 affects Kofax Capture, now referred to as Tungsten Capture, version 6.0.0.0 and possibly other versions. According to the record, a deprecated .NET Remoting HTTP channel on port 2424 is reachable without authentication and uses a publicly known endpoint identifier. The record is rated Critical (CVSS v3.1 9.8), is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

CVE-2026-4810 affects Google Agent Development Kit (ADK) on Python (OSS), Cloud Run and GKE, and combines code injection with missing authentication according to the record. The CNA rates it critical with a CVSS v4.0 score of 9.3, and the record states that an unauthenticated remote attacker could execute code on the host. The issue is reported as fixed in versions 1.28.1 and 2.0.0a2, and no confirmed exploitation appears in the sources consulted.

CVE-2026-41248 is a critical issue in the Clerk JavaScript SDKs, where createRouteMatcher in @clerk/nextjs, @clerk/nuxt and @clerk/astro can be bypassed by certain crafted requests. A successful bypass lets requests skip middleware gating and reach downstream handlers. The record lists fixed versions for each affected package branch, and no confirmed exploitation appears in the sources consulted.