Analysis

JetBrains Kotlin versions before 2.4.20 are affected by an unsafe deserialization weakness (CWE-502) in build cache metadata, which according to the record can allow code execution. NVD rates the issue Critical with a CVSS 3.1 base score of 9.8, while the CNA JetBrains lists 6.7. No confirmed exploitation appears in the sources consulted.

CVE-2026-57700 describes an unrestricted file upload of dangerous type (CWE-434) in Daan.Dev OMGF Pro, which the record says allows the use of malicious files in versions from n/a through 5.2.6. The CNA Patchstack scored it 10.0 (critical) under CVSS 3.1 with network attack vector and no privileges or user interaction required. No fixed version and no confirmed exploitation appear in the sources consulted.

Versions of Claude Code before 2.0.57 did not properly validate directory changes combined with write operations to protected folders such as .claude. According to the record, this could allow files to be created or modified without user confirmation, and the issue is fixed in 2.0.57.

CVE-2026-56445 affects the C-STORE handler of the qrscp application, which uses a value from attacker-supplied DICOM datasets directly in os.path.join() without sanitization, enabling file writes to arbitrary paths (CWE-22). The CNA ICS-CERT assigns CVSS 3.1 9.1 (Critical) and a CVSS 4.0 score of 8.8; the record lists no confirmed exploitation and the CISA KEV catalog does not list it. Affected and fixed versions are not provided in the available record.

GeoVision GV-LPC2011 and GV-LPC2211 devices at V1.12 and earlier contain an unauthenticated stack-based buffer overflow in the thttpd web component. A remote attacker could send a crafted HTTP request with overly long input, leading to memory corruption, denial of service or potentially arbitrary code execution. The CNA rates it critical with a CVSS 3.1 base score of 9.8, and no confirmed exploitation appears in the sources consulted.

CVE-2026-2059 is an SQL injection flaw (CWE-89) in the emp_edit1.php file of SourceCodester Medical Center Portal Management System 1.0, triggered through the ID argument. The record describes remote attack and public disclosure of an exploit, and NVD rates it 9.8 Critical under CVSS 3.1. It is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

LibreChat before 0.8.5 does not check that the resource parameter in OAuth Protected Resource metadata matches the configured MCP server URL. A malicious MCP server could therefore receive access tokens meant for a legitimate server. The description states the issue is fixed in 0.8.5.

CVE-2026-4809 affects plank/laravel-mediable through version 6.4.0. In applications that accept or prefer a client-supplied MIME type, a remote attacker may upload a file containing executable PHP code while declaring a benign image type. The CNA scores it 9.8 under CVSS 3.1, but the record lists no confirmed exploitation and no KEV entry.

CVE-2018-7602 is a critical remote code execution flaw in multiple subsystems of Drupal core, classified as code injection (CWE-94). The record states it is linked to SA-CORE-2018-002 and is listed in the CISA KEV catalog as exploited. Fixed versions and defensive steps are described below.

CVE-2026-32536 affects the Green Downloads WordPress plugin by halfdata, up to and including version 2.08, and is classified as unrestricted upload of a file with a dangerous type (CWE-434). Patchstack, the CNA, rates it critical with a CVSS 3.1 base score of 9.9, and the record lists no fixed version. The CVE is not listed in CISA KEV and the sources consulted show no confirmed exploitation.

CVE-2025-64152 is a path traversal weakness (CWE-22) in Apache IoTDB that allows a pathname to escape a restricted directory. The record lists affected ranges from 1.0.0 before 1.3.6 and from 2.0.0 before 2.0.7, and recommends upgrading to 1.3.6 or 2.0.7. The CNA scored it 9.1 (Critical) under CVSS 3.1, and no confirmed exploitation appears in the sources consulted.

CVE-2026-54849 is an unauthenticated SQL injection flaw in the Premmerce Wishlist for WooCommerce plugin, described for versions up to and including 1.1.11. The CNA rated it critical with a CVSS 3.1 base score of 9.3. The record lists no fixed version, and no confirmed exploitation appears in the sources consulted.

CVE-2026-32499 is a blind SQL injection flaw in the QuantumCloud ChatBot plugin for WordPress, affecting versions through 7.7.9 according to the record. Patchstack and CISA-ADP score it 9.3 (critical) under CVSS 3.1, and the record lists no fixed version. No confirmed exploitation appears in the sources consulted.

CVE-2026-32524 is an unrestricted file upload weakness (CWE-434) in the wplr-sync component of Jordy Meow's Photo Engine, which the record says can be used to upload a web shell to a web server. The CNA Patchstack rates it critical with CVSS 3.1 score 9.1, and the record lists affected versions up to and including 6.4.9 with no fixed version. The CISA KEV catalog does not list it, and no confirmed exploitation appears in the sources consulted.

RTKLIB through 2.4.3 has an out-of-bounds write in the decode_type1033 function, where length counters are not clamped to the destination buffer size. According to the CNA VulnCheck, a crafted RTCM3 correction message delivered over NTRIP or serial could corrupt adjacent memory, and the CVSS 3.1 score is 9.8 (critical). The record shows no KEV listing and no confirmed exploitation in the sources consulted.