Analysis

A vulnerability was found in Yokogawa FAST/TOOLS, affecting versions R9.01 to R10.04, in which the web server accepts access based on IP address. The record maps the weakness to CWE-291 and notes that a worm scanning randomly for IP addresses could potentially attack affected systems after entering a network. NVD assigns a CVSS 3.1 base score of 9.8, and no confirmed exploitation appears in the sources consulted.

A vulnerability in Yokogawa FAST/TOOLS involves improper encoding of URLs, classified as CWE-86. The record states that an attacker could tamper with web pages or execute malicious scripts, and NVD scores it 9.6 (critical) under CVSS v3.1. No fixed version is listed in the record, and no confirmed exploitation appears in the sources consulted.

Hirschmann HiSecOS Classic Firewall versions up to 05.3.02 contain a buffer overflow in the HTTPS login interface when RADIUS authentication is enabled, according to the record's description. The flaw is classified as CWE-120, and VulnCheck scores it 9.8 under CVSS 3.1. No confirmed exploitation appears in the sources consulted, and the record lists no fixed version.

A critical OS command injection flaw (CWE-78) in a dbt-labs reusable GitHub Actions workflow lets attacker-controlled comment text reach a bash if statement. The CNA reports a CVSS 4.0 score of 9.3, and the record states the issue is fixed by commit bbed8d28354e9c644c5a7df13946a3a0451f9ab9. No confirmed exploitation appears in the sources consulted.

CVE-2026-25632 affects EPyT-Flow versions prior to 0.16.1. Its REST API uses a custom JSON deserializer that can dynamically import and instantiate attacker-chosen classes, which the advisory says can lead to OS command execution during JSON parsing. The record rates it critical (CVSS 3.1 base score 10) and states it is fixed in 0.16.1.

CVE-2026-20093 is a critical authentication bypass in the change password functionality of Cisco Integrated Management Controller (IMC), rated 9.8 under CVSS 3.1 by the CNA. The record describes an unauthenticated remote attacker gaining Admin-level access by abusing incorrect handling of password change requests. The record shows no affected versions, fixed releases, or KEV listing, so the vendor advisory is the primary source for remediation.

CVE-2026-22906 is a critical issue in which user credentials are encrypted with AES-ECB using a hardcoded key, as reported by the CNA info@cert.vde.com with a CVSS 3.1 base score of 9.8. According to the record, an unauthenticated remote attacker who obtains the configuration file could recover plaintext usernames and passwords. The record does not list affected products, versions or fixes, so the vendor advisory VDE-2026-004 is the primary source to consult.

CVE-2026-2174 is an improper authentication flaw (CWE-287) reported in code-projects Contact Management System 1.0, in an unspecified part of the CRUD Endpoint component. NVD scores it CVSS 3.1 9.8 (Critical) with a network attack vector and no privileges required, while the CNA VulDB reports lower scores under other CVSS versions. No fixed version is listed in the record and the CVE is not in CISA KEV.

CVE-2026-39620 is a cross-site request forgery (CWE-352) flaw in the Appointment product by priyanshumittal, which the record says can be used to upload a web shell to a web server. Patchstack, the CNA, rates it critical with a CVSS 3.1 base score of 9.6, and the record covers versions through 3.5.5. The record lists no affected or fixed versions and the CVE is not in CISA KEV.

CVE-2026-2171 is an SQL injection flaw in the Login component (accounts.php) of code-projects Online Student Management System 1.0, reachable remotely through the username and password arguments. NVD assigns a CVSS 3.1 base score of 9.8, and the description states that a public exploit exists. The record does not list a fixed version, and the CVE is not in the CISA KEV catalog.

CVE-2026-2114 is a critical SQL injection issue in itsourcecode Society Management System 1.0, reachable remotely through the admin_id argument of /admin/edit_admin.php. NVD assigns a CVSS 3.1 base score of 9.8, while the CNA VulDB lists lower scores under other CVSS versions. The record states that a public exploit exists, but the CVE is not listed in CISA KEV, so no confirmed active exploitation appears in the sources consulted.

CVE-2026-2115 describes an SQL injection flaw in itsourcecode Society Management System 1.0, reachable through the expenses_id argument of /admin/delete_expenses.php. The NVD assigns a CVSS 3.1 base score of 9.8 (critical), and the record states that an exploit has been published. The CVE is not listed in the CISA KEV catalog, and no fixed version is recorded in the sources consulted.

A buffer overflow in the alarm scheduling feature of Parallaxis Cuckoo Clock 5.0 is classified as CWE-121, with a CVSS 3.1 base score of 9.8 recorded from VulnCheck. The record lists no affected or fixed versions and no CISA KEV listing, so remediation details and exploitation status are largely unknown.

CVE-2025-14816 is a cleartext storage weakness (CWE-317) in the GUI of several Mitsubishi Electric and ICONICS industrial software products. The record states that SQL Server credentials are shown in plain text in the Hyper Historian Splitter feature when SQL authentication is used, and the CNA rates it 9.3 under CVSS 4.0. No fixed versions are listed in the record, so administrators should consult the vendor advisory and limit local access.

A SQL injection flaw has been reported in Projectworlds Online Food Ordering System 1.0, in the ID argument of /view-ticket.php, and it can be triggered remotely. NVD rates it 9.8 (Critical) under CVSS 3.1, and the record states that a published exploit may be used. CISA KEV does not list this CVE, so no confirmed active exploitation appears in the sources consulted.