Analysis

CVE-2026-25858 affects macrozheng mall version 1.0.3 and prior, where the mall-portal password reset workflow exposes the one-time password in the API response. According to the record, an unauthenticated attacker could use only a victim's telephone number to reset account passwords, and NVD lists it with CVSS 3.1 9.8 while VulnCheck lists 9.1.

CVE-2026-1830 affects the Quick Playground plugin for WordPress in all versions up to and including 1.3.1. According to the record, missing authorization checks on REST API endpoints can let unauthenticated attackers reach remote code execution, with a CVSS 3.1 score of 9.8 (critical). The record shows no confirmed exploitation in the wild and no fixed version.

CVE-2020-37095 is recorded against Cyberoam Authentication Client 2.1.2.7 as a stack-based buffer overflow that can allow remote code execution by overwriting SEH memory. The record gives a CVSS 3.1 base score of 9.8 (critical) from VulnCheck. It shows no CISA KEV listing and no structured affected or fixed version data.

CVE-2026-2211 is an SQL injection weakness in code-projects Online Music Site 1.0, tied to an administrative category-deletion function where the ID argument is not handled safely. NVD scores it 9.8 (CVSS 3.1, critical), the CNA VulDB scores are lower, and the record states that a public exploit exists. The record does not show a KEV listing, confirmed exploitation in the wild, or a fixed version.

CVE-2025-6830 is an SQL injection flaw (CWE-89) in the Password Module from Xpoda Türkiye Information Technology Inc., as described in the record. The CNA USOM assigned a CVSS 3.1 base score of 9.8 (critical) for a network-reachable, low-complexity flaw requiring no privileges. No confirmed exploitation appears in the sources consulted, and the record lists no affected or fixed versions in structured fields.

CVE-2026-25753 affects Prasklatechnology PlaciPy version 1.0.0, a placement management system for educational institutions. New student accounts receive a hard-coded, static default password, which enables mass account takeover once that password is known. NVD rates it CVSS 3.1 9.8 (Critical), and no confirmed exploitation appears in the sources consulted.

GitLab fixed a critical vulnerability in the Duo Workflow Service component of GitLab AI Gateway, caused by insecure template expansion of user-supplied data in crafted Duo Agent Platform Flow definitions. According to the record, it could be used to cause denial of service or gain code execution on the Gateway. The record states fixes in versions 18.6.2, 18.7.1 and 18.8.1.

CVE-2018-25236 is an improper authentication flaw (CWE-287) in the HTTP(S) management module of Hirschmann HiOS and HiSecOS products, according to the record. The record states that an unauthenticated remote attacker could gain administrative access using crafted HTTP requests, and it carries a CVSS 3.1 base score of 9.8 from VulnCheck. The record lists no fixed versions and no confirmed exploitation in the KEV catalog.

WPCafe (wp-cafe) by Arraytics has a missing authorization flaw (CWE-862) reported for versions from n/a through 3.0.7. The CNA scores it CVSS 3.1 9.1 (critical), and the record lists no fixed version. It is not in CISA KEV and no confirmed exploitation appears in the sources consulted.

CVE-2026-7531 is a use-after-free (CWE-416) in wolfSSL's handling of post-quantum hybrid key shares in TLS 1.3. The record describes it as an incomplete-fix follow-up to CVE-2026-5460, and NVD scores it 9.8 (critical) under CVSS 3.1. A patch is referenced in the wolfSSL pull request, and the record shows no confirmed exploitation.

CVE-2025-55017 is a path traversal flaw (CWE-22) in Apache IoTDB, affecting 2.0.0 before 2.0.6 and 1.0.0 before 1.3.6. The CNA rates it critical with a CVSS 3.1 base score of 9.1, and the vector indicates network access without privileges or user interaction. Upgrading to 1.3.6 or 2.0.6 is the recommended remediation, and no confirmed exploitation appears in the sources consulted.

CVE-2026-2012 describes an SQL injection flaw in itsourcecode Student Management System 1.0, reachable remotely through the facultyloading page. The CNA (VulDB) and NVD rate it critical, with NVD assigning CVSS 3.1 9.8. The record states that an exploit has been publicly disclosed, but the CVE is not listed in the CISA KEV catalog.

OpenSlides, a web-based presentation and assembly system, has an improper access control issue affecting users synced through an external SAML identity provider. According to the record, the local login form accepted the OpenSlides username of a SAML user with a trivial password that was valid for all such users. NVD rates it critical with a CVSS 3.1 base score of 9.8, and the record states it is fixed in version 4.2.29.

CVE-2020-37126 is a stack-based buffer overflow in Free Desktop Clock 3.0, triggered through the Time Zones display name input. According to the record, a crafted Unicode input can overwrite Structured Exception Handler registers and potentially allow arbitrary code execution. The record reports a CVSS 3.1 score of 9.8 (critical), no confirmed exploitation in CISA KEV, and no affected or fixed versions.

WPJAM Basic, a WordPress plugin by denishua, contains an unrestricted file upload weakness (CWE-434) that the record places at versions through 6.9.2. Patchstack, the CNA, scored it 9.9 (critical) under CVSS 3.1. The record lists no fixed version and no confirmed exploitation in the sources consulted.