Analysis

CVE-2026-1709 is a critical authentication bypass in the Keylime registrar, which the record says does not enforce client-side TLS authentication. According to the record, an unauthenticated client with network access could perform administrative operations such as listing agents, retrieving public TPM data and deleting agents. The sources consulted show no confirmed exploitation, and the record lists no fixed version.

CVE-2026-3296 is a critical PHP Object Injection flaw in the Everest Forms plugin for WordPress, affecting all versions up to and including 3.4.3. According to the record, unauthenticated attackers can submit serialized data through public form fields, and that data is later processed by an unsafe deserialization call when an administrator views form entries. Wordfence rates it 9.8 (CVSS 3.1), and the record shows no KEV listing, so site owners should review their plugin version and restrict access to entry data.

A SQL injection vulnerability (CWE-89) has been reported in the login handling at /login/index.php of code-projects Online Reviewer System 1.0, where the record states that manipulation of the username and password arguments leads to SQL injection. NVD scores it 9.8 (critical) under CVSS 3.1, and the record states the attack can be carried out remotely and that a public exploit has been disclosed. The CVE is not listed in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted.

The Users manager – PN plugin for WordPress contains a missing authorization flaw (CWE-862) in its 'userspn_form_save' AJAX handling, which the record says allows unauthenticated users to update arbitrary user metadata. The record attributes a CVSS 3.1 score of 9.8 (Critical) to the issue, affecting versions up to and including 1.1.15, and lists no fixed version. No confirmed exploitation in the wild appears in the sources consulted.

A SQL injection flaw (CWE-89) has been reported in code-projects Online Music Site 1.0, in a file under the Administrator area, through the txtcat argument. NVD lists a CVSS 3.1 base score of 9.8 and the record says the attack can be carried out remotely. The record states that a public exploit has been released, but the CVE is not listed in CISA KEV and no confirmed active exploitation appears in the sources consulted.

WeKan versions before 8.19 contain an LDAP filter injection flaw (CWE-90) in LDAP authentication, where username input is not adequately escaped before use in search filters and DN-related values. NVD rates it 9.8 under CVSS 3.1 (critical), and VulnCheck rates it 8.7 under CVSS 4.0. The record does not list the CVE in CISA KEV, so no confirmed exploitation appears in the sources consulted, but administrators should review the affected range and the referenced patch.

CVE-2026-2161 is a SQL injection flaw in the /admin/forget-password.php file of itsourcecode Directory Management System 1.0, triggered through the email argument and reachable remotely. The NVD record carries a CVSS 3.1 base score of 9.8 (critical), while the CNA scores range from 2.0 to 4.0 versions. The record states that a public exploit exists, but CISA KEV does not list the CVE and no confirmed exploitation appears in the sources consulted.

CVE-2026-25520 affects SandboxJS versions prior to 0.8.29, where function return values are not wrapped, allowing host objects to be reached from inside the sandbox. The record describes a path to run arbitrary code outside the sandbox, and it is fixed in 0.8.29. The CVSS 3.1 base score recorded is 10.0 (critical), and the CISA KEV catalog does not list it.

CVE-2026-2073 is an SQL injection weakness (CWE-89) in itsourcecode School Management System 1.0, affecting the ID argument handled by /ramonsys/user/index.php. NVD rates it Critical with a CVSS 3.1 base score of 9.8, and the record states that an exploit has been publicly disclosed. The record shows no confirmed active exploitation and no vendor fix.

CVE-2026-2220 is an SQL injection flaw (CWE-89) in code-projects Online Reviewer System 1.0, triggered by manipulation of the difficulty_id argument and described as remotely exploitable. NVD assigns CVSS 3.1 9.8 (critical), and the CNA VulDB lists lower scores under other CVSS versions. The record states that a public exploit exists, but the CVE is not listed in CISA KEV and no confirmed exploitation appears in the sources consulted.

CVE-2020-37161 is a stack-based buffer overflow (CWE-121) in Wedding Slideshow Studio up to version 1.36, triggered through the registration name field. The record describes possible arbitrary code execution and is scored Critical (CVSS 3.1 base score 9.8) by VulnCheck. No fixed version is listed, and the sources consulted show no confirmed exploitation in the wild.

A SQL injection weakness was reported in the /admin/edit_expenses.php file of itsourcecode Society Management System 1.0, where the expenses_id argument is not handled safely. The record states the issue can be triggered remotely and that exploit details have been made public. No fixed version is listed in the sources consulted, so administrators should restrict access and review the affected application.

The Agentspace service used predictable Google Cloud Storage bucket names for error logs and temporary staging during data imports from GCS and Cloud SQL. This predictability allowed an attacker to create those buckets before a customer's first use, a pattern the record calls bucket squatting. The record states that versions after December 12, 2025 include the update and that no user action is required.

CVE-2026-2130 is a command injection weakness (CWE-77) in mcp-maigret up to version 1.0.12, in the search_username component, reachable through the Username argument. The record states the attack may be launched remotely. NVD rates it critical with CVSS 3.1 9.8, while the CNA VulDB lists lower scores, and version 1.0.13 is reported to mitigate the issue with no confirmed exploitation in the sources consulted.

CVE-2026-25752 is an authorization bypass in FUXA, a web-based SCADA/HMI application, that lets an unauthenticated remote attacker modify device tags through WebSockets. According to the record, the issue affects FUXA through version 1.2.9 and is patched in version 1.2.10. No confirmed exploitation appears in the sources consulted, and the record does not list KEV status.