Analysis

A command injection flaw (CWE-77) was reported in the setPortalConfWeChat function of the Totolink A7100RU firmware 7.4cu.2313_b20191024, reached through the CGI handler at /cgi-bin/cstecgi.cgi. The CNA assigned a CVSS 3.1 base score of 9.8 (critical), and the record states that an exploit has been released publicly. The CVE is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted.

CVE-2026-2449 is an argument injection weakness (CWE-88) in upKeeper Instant Privilege Access, described by the CNA as allowing hijacking of a privileged thread of execution. The CNA-provided CVSS v4.0 score is 9, rated critical, and the record is still awaiting analysis. No confirmed exploitation appears in the sources consulted.

excel-mcp-server, a Model Context Protocol server for Excel files, has a path traversal flaw (CWE-22) in versions up to and including 0.1.7 when used over SSE or Streamable-HTTP transport. The record states that an unauthenticated network attacker could read, write and overwrite arbitrary files on the host, and that the issue is fixed in 0.1.8. The record reports a CVSS 3.1 base score of 9.4, and CISA KEV does not list this CVE.

CVE-2026-2087 describes an SQL injection flaw in the /admin/login.php page of Online Class Record System 1.0, triggered through the user_email parameter and reachable remotely according to the record. NVD lists a CVSS 3.1 base score of 9.8, and the description states that a public exploit has been published. The CISA KEV catalog does not list this CVE, and the record contains no fixed version.

CVE-2025-15027 affects the JAY Login & Register plugin for WordPress in all versions up to and including 2.6.03. According to the record, a flaw in the function jay_login_register_ajax_create_final_user lets a user update arbitrary user metadata, which can allow an unauthenticated attacker to gain administrator privileges. The CNA rated it critical with a CVSS 3.1 score of 9.8, and no confirmed exploitation appears in the sources consulted.

Claude Code versions before 2.1.2 did not protect the .claude/settings.json file under the bubblewrap sandbox when that file was absent at startup. Code running inside the sandbox could create it and register hooks that run with host privileges when Claude Code restarts. The advisory states the issue is patched in version 2.1.2, and NVD rates it critical with a CVSS 3.1 score of 10.

CVE-2026-25848 is a missing-authentication flaw in JetBrains Hub versions before 2025.3.119807 that allows authentication to be bypassed for administrative actions. NVD scores it 9.8 (CVSS 3.1, critical), while JetBrains as CNA scores it 9.1. The record does not show it in CISA KEV, and no confirmed exploitation appears in the sources consulted.

CVE-2025-14815 is a cleartext storage weakness (CWE-312) in several Mitsubishi Electric and ICONICS industrial software products, where SQL Server credentials are kept in plaintext in a local SQLite file when the local caching feature is enabled and SQL authentication is used. The CNA assigned a CVSS 4.0 base score of 9.3 (critical), and the attack requires local access. The record does not list fixed versions, and no confirmed exploitation appears in the sources consulted.

CVE-2026-2172 is a SQL injection flaw (CWE-89) in the enrollment/index.php file of the Login Endpoint component of code-projects Online Application System for Admission 1.0. The CNA describes remote exploitation, and NVD scores it 9.8 (critical) under CVSS 3.1. The record states a public exploit has been disclosed, but no fixed version and no confirmed exploitation in the sources consulted.

A SQL injection flaw (CWE-89) has been reported in code-projects Social Networking Site 1.0, in the delete_post.php file, through the ID argument. According to the record, it can be triggered remotely and a public exploit has been released, while the NVD assigns a CVSS 3.1 base score of 9.8. CISA KEV does not list this CVE and the sources consulted do not confirm exploitation in the wild.

A vulnerability in the WebUploader component of yuan1994 tpadmin up to version 1.3.12 leads to deserialization and can reportedly be exploited remotely. NVD rates it 9.8 (critical) under CVSS 3.1, and the record states that an exploit has been publicly disclosed. No fixed version is listed in the sources consulted, and the record says only unsupported products are affected.

CVE-2026-39640 is a Cross-Site Request Forgery (CSRF) issue in the Theme Editor plugin by mndpsingh287, which the record says allows code injection. The description covers versions from n/a through 3.2, and the CNA Patchstack scored it 9.6 (critical) under CVSS 3.1. The record lists no fixed version, no KEV listing and no confirmed exploitation in the sources consulted.

According to the record, Hirschmann HiEOS devices before 01.1.00 contain an authentication bypass in the HTTP(S) management module that can give unauthenticated remote attackers administrative access. CVSS 3.1 scores it 9.8 (critical). No KEV listing or confirmed exploitation appears in the sources consulted.

The Ninja Forms - File Uploads plugin for WordPress lacks file type validation, which lets unauthenticated attackers upload arbitrary files. Wordfence rates the issue critical with a CVSS 3.1 score of 9.8. According to the record, versions up to and including 3.3.26 are affected and 3.3.27 is the full fix.

CVE-2017-20237 affects Belden Hirschmann Industrial HiVision versions prior to 06.0.07 and 07.0.03, where an authentication bypass in the master service can let unauthenticated remote attackers run commands with administrative privileges. The record gives a CVSS 3.1 base score of 9.8 (critical) and classifies the flaw as CWE-287. No fixed version is listed in the record, and CISA KEV does not list this CVE.