Analysis

Google reported a missing authorization issue in several internal API endpoints of Google Cloud Application Integration, affecting builds prior to 2026-01-23. The record rates it CVSS v4.0 10 and says an unauthenticated remote attacker could disclose information or execute code. The record shows no KEV listing, no confirmed exploitation in the consulted sources, and no fixed version.

CVE-2026-42758 is an incorrect privilege assignment flaw (CWE-266) in the WebinarIgnition webinar plugin for WordPress that enables privilege escalation. The CNA, Patchstack, rated it 9.8 (Critical) under CVSS 3.1, and the record lists affected versions as those before 4.08.253. The sources consulted do not confirm exploitation in the wild, and the record does not list fixed versions.

The Easy Elements for Elementor plugin for WordPress allows unauthenticated users to register with the administrator role in versions up to and including 1.4.4, because the registration handler does not restrict assignable roles. The record assigns a CVSS 3.1 score of 9.8 (Critical) from Wordfence. No confirmed exploitation appears in the sources consulted, and the record does not list a fixed version.

Kavita versions before 0.9.0.2 contain an improper token validation flaw (CWE-287) that lets a remote, unauthenticated actor who knows a username request a JWT for that user, including administrators. The CNA rated it critical with a CVSS 4.0 base score of 9.3, and the description states it is fixed in 0.9.0.2. No confirmed exploitation appears in the sources consulted, and the CVE is not listed in CISA KEV.

CVE-2020-37228 affects the iDS6 DSSPro Digital Signage System 6.2 and is described as a CAPTCHA security bypass that can enable authentication bypass and brute-force attempts against user accounts. The CNA VulnCheck rates it critical, with a CVSS v3.1 base score of 9.8 and a CVSS v4.0 score of 9.3. The record shows no KEV listing and no confirmed in-the-wild exploitation, and affected and fixed version data are missing.

CVE-2026-9455 is an OS command injection flaw in the Web Management Interface of Totolink A8000RU firmware 7.1cu.643_b20200521. The record states that manipulating the FileName argument in the UploadOpenVpnCert function of /cgi-bin/cstecgi.cgi can lead to command execution and that remote exploitation is possible. The CNA rates it critical with a CVSS 3.1 base score of 9.8, and the record notes that exploit information has been publicly disclosed, but CISA KEV does not list it.

CVE-2026-42747 is a critical blind SQL injection in the Easy Form Builder plugin by hassantafreshi, scored 9.3 under CVSS 3.1 by the CNA Patchstack. The record states that versions through 4.0.6 are affected, but it lists no fixed version. The record shows no KEV listing, and no confirmed exploitation appears in the sources consulted.

CVE-2026-45444 is an unrestricted file upload weakness in the WP Swings Gift Cards For WooCommerce Pro WordPress plugin, affecting versions up to and including 4.2.6, as reported by Patchstack. The record assigns a CVSS 3.1 base score of 10 (critical) with network attack vector and no privileges or user interaction required. No confirmed exploitation appears in the sources consulted, and the CISA KEV catalog does not list this CVE.

CVE-2026-44050 is a heap-based buffer overflow in the comm_rcv() function of the CNID daemon in Netatalk 2.0.0 through 4.4.2. The record describes a remote attacker with valid credentials who could execute arbitrary code with escalated privileges or cause a denial of service, and it carries a critical CVSS 3.1 score of 9.9. The record lists no fixed version, is not in CISA KEV, and shows no confirmed exploitation in the sources consulted.

HTTP::Daemon for Perl versions before 6.17 contain an OS command injection flaw in send_file(), tracked as CVE-2026-8450. Untrusted input can run commands with the daemon's privileges and create or truncate files at attacker-chosen paths. The record lists CVSS 3.1 scores of 9.1 and 8.1, and no confirmed exploitation appears in the sources consulted.

CVE-2026-9434 is a critical OS command injection (CWE-77) in the Web Management Interface of the Totolink A8000RU firmware 7.1cu.643_b20200521. The record states that manipulating the wscDisabled argument of the setWiFiWpsCfg function in /cgi-bin/cstecgi.cgi can be done remotely and that a public exploit has been disclosed. No confirmed active exploitation and no fixed version appear in the sources consulted.

A critical OS command injection flaw (CWE-77) affects the Web Management Interface of Totolink A8000RU firmware 7.1cu.643_b20200521. The record describes remote exploitation through the setL2tpServerCfg function and states that an exploit has been published. No fixed version is listed, so mitigation centers on restricting access to the management interface.

A path traversal flaw in the StorageController of the Altium Enterprise Server Viewer lets an authenticated user read arbitrary files on on-premise servers that use local filesystem storage. The record notes that the readable server master configuration holds database credentials, signing key locations and OAuth secrets, so exposure could extend to all server secrets. The record rates the issue critical with a CVSS 4.0 score of 9.4 and shows no confirmed exploitation in the sources consulted.

CVE-2026-2264 affects the SetIntegrationRequest policy in Google Cloud Apigee-X and allows Server-Side Request Forgery (SSRF) and exfiltration of service account access tokens. The record rates it critical with CVSS 4.0 base score 9.2 and states that exploitation requires an administrator to first create an insecure API proxy configuration. No confirmed exploitation appears in the sources consulted, and the CVE is not listed in CISA KEV.

CVE-2026-42748 is an unrestricted file upload vulnerability (CWE-434) in the WPify Woo Czech plugin for WordPress, affecting versions up to and including 5.4.1. The record states that it allows an attacker to upload a web shell to the web server, and the Patchstack CNA rates it 9.9 (Critical) under CVSS 3.1. No fixed version and no confirmed exploitation were found in the sources consulted.