Analysis

CVE-2019-25298 describes multiple SQL injection flaws in html5_snmp 1.11, a product attributed to Lolypop55, affecting the Router_ID and Router_IP parameters. NVD and VulnCheck rate it critical with a CVSS 3.1 base score of 9.1, and the record is classified as CWE-89. CISA KEV does not list it and no confirmed exploitation appears in the sources consulted, though an Exploit-DB entry is referenced.

NVD and the CNA describe a Node.js flaw in TLS hostname handling, where hostnames with an embedded NUL byte can be truncated in resolver bindings and lead to silent authority rebinding. NVD rates it critical with CVSS 3.1 score 9.8, and the record lists Node.js 22, 24 and 26 release lines as affected. No confirmed exploitation appears in the sources consulted.

Gogs versions 0.13.3 and earlier remain exposed to remote command execution because the earlier fix for CVE-2024-56731 was insufficient. The issue is classified as OS command injection (CWE-78) and rated critical, with an NVD CVSS 3.1 base score of 9.8. Upgrading to 0.13.4 or 0.14.0+dev is the main remedy, and the sources consulted show no confirmed active exploitation.

CVE-2026-54917 is a path traversal flaw in the S3 API and Iceberg REST catalog gateways of SeaweedFS before version 4.30. Because path cleaning is disabled in the router, parent-directory segments in object keys can redirect a request to another bucket. The record assigns a critical severity and states that the issue is fixed in 4.30.

CVE-2026-57926 is a prototype pollution weakness (CWE-1321) in the websandbox bridge of JetBrains YouTrack before 2026.2.16593. NVD rates it critical with a CVSS 3.1 base score of 9.8, while the CNA lists a separate score of 2.6. No confirmed exploitation appears in the sources consulted, and the record shows no fixed-version entry, so the vendor advisory should be checked directly.

According to the record, a code injection flaw (CWE-94) affects the JetFormBuilder product from jetmonsters in versions up to and including 3.5.6.1. The CNA assigned a critical CVSS 3.1 base score of 9.9, and the vector indicates network reachability with low privileges required. No fixed version and no confirmed exploitation appear in the sources consulted.

CVE-2026-54823 is a critical remote code execution issue in Widget Options versions up to and including 4.2.3, classified as CWE-94 (Code Injection). The CNA scored it 9.9 under CVSS 3.1 with a changed-scope vector that requires low privileges and no user interaction. The available records do not list fixed versions, and the vulnerability is not in CISA KEV.

CVE-2026-24300 is a critical elevation of privilege vulnerability in Microsoft Azure Front Door, classified as improper access control (CWE-284), with a CVSS 3.1 base score of 9.8 reported by the CNA. The available record does not specify affected versions or fixed builds, so the Microsoft Security Update Guide is the primary source to consult. No confirmed exploitation appears in the sources consulted.

CVE-2026-27049 is an authentication bypass using an alternate path or channel (CWE-288) in NooTheme Jobica Core (jobica-core), with the record stating affected versions through 1.4.2. The CNA Patchstack rates it critical with a CVSS 3.1 base score of 9.8. The record provides no fixed version and no confirmed exploitation.

CVE-2026-27083 is a deserialization of untrusted data weakness (CWE-502) in the work-travel-company theme by ThemeREX, affecting Work & Travel Company versions up to and including 1.2 as described in the record. The CNA Patchstack scored it 9.8 (critical) under CVSS 3.1 with network attack vector and no privileges or user interaction required. No confirmed exploitation appears in the sources consulted, and no fixed version is listed in the available record.

Missing authentication on WebSocket endpoints could allow attackers to impersonate charging stations. The CNA rates the issue critical, with a CVSS 3.1 base score of 9.4. The record lists no affected or fixed versions.

CVE-2026-2053 affects the message flow component of WSO2 API Manager, which does not sufficiently validate user-controlled input in WS-Addressing headers, enabling Server-Side Request Forgery (CWE-918). The NVD assigns a CVSS 3.1 base score of 10.0 (Critical) with network attack vector and no privileges or user interaction required. Defenders should identify deployments within the listed affected ranges, consult the vendor advisory for fixed builds, and restrict outbound traffic from API Manager hosts to internal resources.

CVE-2026-50548 is a path traversal weakness (CWE-22) in Cursor versions before 3.0, where the sandbox used for agent terminal commands can include writable paths outside the intended workspace. According to the record, this could let a malicious agent write files outside the workspace with the user's privileges and lead to non-sandboxed remote code execution. NVD scores it CVSS 3.1 9.8 (Critical), the record says it is fixed in 3.0, and no confirmed exploitation appears in the sources consulted.

CVE-2020-37124 describes a stack-based buffer overflow in b64dec 1.1.2 that can let an attacker overwrite the Structured Exception Handler with crafted input during base64 decoding. The record carries a CVSS 3.1 base score of 9.8 (critical) from VulnCheck, and CISA KEV does not list it. The sources consulted do not document affected or fixed versions beyond the one named in the description.

CVE-2026-54836 is a critical SQL injection vulnerability in YMC Filter, reported by Patchstack with a CVSS 3.1 base score of 9.3. The record places affected versions at n/a through 3.11.5 but lists no structured fixed version. The CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.