Analysis

CVE-2026-27044 is a code injection weakness (CWE-94) in the Total Poll Lite plugin (totalpoll-lite) by TotalSuite, which the CNA describes as allowing remote code inclusion. The record lists versions through 4.12.0 as affected and assigns a CVSS 3.1 base score of 9.9 from Patchstack. No fixed version and no confirmed exploitation appear in the sources consulted.

CVE-2026-25526 is a critical sandbox bypass in HubSpot JinJava, a Java template engine, through its ForTag component. According to the record, it allows arbitrary Java class instantiation and file access, and the CNA scores it 9.8 under CVSS v3.1. The issue is fixed in versions 2.7.6 and 2.8.3, and no confirmed exploitation appears in the sources consulted.

CVE-2019-5786 is a use-after-free flaw (CWE-416) in the Blink rendering engine of Google Chrome before 72.0.3626.121, which a remote attacker could potentially trigger with a crafted HTML page. CISA lists it in the Known Exploited Vulnerabilities catalog, and the record also lists npm Puppeteer below 1.13.0 as affected. Updating Chrome and Puppeteer is the main defensive step.

CVE-2025-68723 is a stored cross-site scripting issue in the WebAdmin interface of Axigen Mail Server, present in three places in the administration console. NVD rates it 9.0 (Critical) under CVSS 3.1, and the record lists affected ranges from 10.3.0 up to before 10.5.57 and from 10.6.0 up to before 10.6.26. No confirmed exploitation appears in the sources consulted, and the record shows the CVE is not listed in CISA KEV.

CVE-2026-32502 is an insecure deserialization flaw (CWE-502) that allows object injection in the borgholm-marketing-agency-theme published by Select-Themes, affecting Borgholm versions below 1.6 according to the record. The CNA Patchstack scored it 9.8 (Critical) under CVSS 3.1, with network attack vector and no privileges or user interaction required. No confirmed exploitation appears in the sources consulted, and the record lacks structured affected and fixed version data.

File Browser versions before 2.63.6 pass login credentials unsanitized into an external shell command used by the Hook Authentication feature. The record describes this as an unauthenticated, pre-authentication remote code execution flaw rated critical (CVSS v4.0 9.3, CWE-78). Upgrading to 2.63.6 or later is the primary remediation.

CVE-2026-2014 is an SQL injection weakness in itsourcecode Student Management System 1.0, triggered through the ID argument of the /ramonsys/billing/index.php file. The record states that remote exploitation is possible and that an exploit has been publicly released. NVD assigns a CVSS 3.1 base score of 9.8 (critical), and CISA KEV does not list this CVE.

Go's crypto/tls can accept a resumed TLS session after the ClientCAs or RootCAs fields of its Config change, when the resumed handshake should have failed. The record maps it to CWE-295 and lists an NVD CVSS 3.1 score of 10, with affected ranges below 1.24.13, from 1.25.0 to below 1.25.7, and two 1.26 pre-releases. The record does not list the CVE in CISA KEV, and no confirmed exploitation appears in the sources consulted.

CVE-2020-37138 is a stack-based buffer overflow (CWE-121) in the file import feature of 10-Strike Network Inventory Explorer 9.03, which the record says can allow remote code execution. The CVSS 3.1 base score in the record is 9.8 (critical), and no CISA KEV listing or confirmed exploitation appears in the sources consulted. No fixed version is listed in the record, so administrators should verify vendor updates and restrict untrusted file imports.

CVE-2026-25547 affects @isaacs/brace-expansion versions prior to 5.0.1. Repeated numeric brace ranges make the library synchronously generate every combination, which can exhaust CPU and memory and crash a Node.js process. The fix is in version 5.0.1, and no confirmed exploitation appears in the sources consulted.

CVE-2026-25377 is a SQL injection weakness (CWE-89) in the eyecix Addon Jobsearch Chat WordPress addon, as described in the record. The CNA rated it critical with a CVSS 3.1 base score of 9.3, and the description places affected versions at n/a through 3.0 inclusive. The record lists no fixed version and no confirmed exploitation in the sources consulted.

CVE-2020-37137 is a critical remote code execution flaw in PHP-Fusion 9.03.50, where unsanitized POST data reaches an eval() call in the add_panel_form() function. The NVD assigns CVSS 3.1 base score 9.8, and the record classifies the weakness as CWE-94 (Code Injection). The record shows no fixed version and no KEV listing, so patch status and exploitation status require checking vendor and CNA sources.

File Browser versions starting with 2.0.0-rc.1 that use proxy authentication (auth.method=proxy) can let an unauthenticated attacker with direct network access to the server impersonate any user, including administrators. The same condition can also let an attacker create user accounts by specifying a non-existent username. The record rates the issue critical with a CVSS 3.1 score of 9.1, and no confirmed exploitation appears in the sources consulted.

CVE-2026-4317 is a SQL injection flaw (CWE-89) in the Umami Software web application, where the 'timezone' request parameter is not properly sanitized before use in a database query. The CNA INCIBE-CERT assigns a CVSS 4.0 score of 9.3 (critical), and the record states that an authenticated attacker could affect database data. No confirmed exploitation appears in the sources consulted, and the record lists no affected or fixed versions.

CVE-2026-56123 affects socat versions 1.8.0.0 through 1.8.1.1, where a sign-extension flaw in the DOMAINNAME reply parser can lead to a heap-based buffer overflow when a malicious SOCKS5 proxy server is involved. NVD assigns a CVSS 3.1 base score of 9.8 (critical), and the record shows no CISA KEV listing or EPSS score. The affected range in the record excludes 1.8.1.2 and later, but no fix reference is listed, so administrators should verify the fix against the vendor release notes.