Analysis

CVE-2026-0106 is a missing bounds check in the vpu_mmap routine of vpu_ioctl in Google Android, which the CNA says can allow an arbitrary address mmap. The CNA describes possible local privilege escalation without additional execution privileges and without user interaction, and reports a CVSS 3.1 base score of 9.3 (critical). No confirmed exploitation appears in the sources consulted, and the record does not list affected or fixed version ranges.

CVE-2026-54843 describes an unauthenticated SQL injection flaw (CWE-89) in MDTF versions up to and including 1.3.7. The CNA assigned a critical CVSS v3.1 base score of 9.3 with a network, low-complexity, no-privileges, no-user-interaction vector. No fixed version and no confirmed exploitation in the wild appear in the sources consulted.

CVE-2026-34205 affects Home Assistant apps (formerly add-ons) configured with host network mode, which expose unauthenticated endpoints to the local network on Linux. The record states that any device on the same network can reach these endpoints, and that Home Assistant Supervisor 2026.03.02 addresses the issue. The record scores it as critical (CVSS 3.1, 9.6), but it lists no KEV entry and no confirmed exploitation.

CVE-2026-4257 is a server-side template injection flaw in the Contact Form by Supsystic plugin for WordPress, affecting all versions up to and including 1.7.36. The CNA Wordfence scored it CVSS 3.1 9.8 Critical and describes possible remote code execution by unauthenticated users. The sources consulted show no confirmed exploitation, and the record does not identify a fixed version.

AsyncHttpClient (AHC) versions before 3.0.13 and 2.16.1 can replay a request to a different host while the target request and proxy context still point to the original origin. Per the record, this can send the original host's path, Host header, Authorization credentials, or plaintext requests to the replay destination. The GitHub CNA scores the issue 9.4 under CVSS 4.0, and the record shows no KEV listing or confirmed exploitation in the sources consulted.

CVE-2019-1003029 is a sandbox bypass in the Jenkins Script Security Plugin 1.53 and earlier that lets users with Overall/Read permission run arbitrary code on the Jenkins master JVM. NVD rates it critical with a CVSS 3.1 base score of 9.9, and CISA lists it in the Known Exploited Vulnerabilities catalog. The record names no fixed version, so administrators should follow the Jenkins advisory and update the plugin.

CVE-2020-37119 is a buffer overflow in the DNS Lookup tool of Nsasoft Nsauditor versions 3.0.28 and 3.2.1.0, classified as an out-of-bounds write (CWE-787). The CNA VulnCheck assigned a CVSS 3.1 base score of 9.8 (critical), and the record also carries a CVSS 4.0 score of 8.4. The record shows no CISA KEV listing, no confirmed exploitation in the sources consulted, and no fixed version.

CVE-2026-2058 is a SQL injection flaw (CWE-89) in mathurvishal CloudClassroom-PHP-Project, reported in the file /postquerypublic.php. The NVD record assigns a CVSS 3.1 score of 9.8 (Critical), while a CNA score of 7.3 also appears. No fix is listed in the record, and the CISA KEV data does not list the issue.

GeoVision GV-LPC2011 and GV-LPC2211 devices at V1.12 and earlier contain a stack-based buffer overflow in the ssvr component when it processes RTSP custom authentication data. The record gives a CVSS 3.1 base score of 9.8 (critical) and requires no authentication. The record does not list the CVE in CISA KEV, and no fixed version appears in the sources consulted.

CVE-2020-37125 is a critical OS command injection flaw (CWE-78) in Edimax EW-7438RPn Mini firmware version 1.27, reachable without authentication through the /goform/mp endpoint. The CNA scores it 9.8 under CVSS 3.1 and 9.3 under CVSS 4.0. The record lists no fixed version and no KEV listing, so organizations should prioritize exposure reduction and verify the vendor's current firmware status.

A SQL injection weakness (CWE-89) was reported in itsourcecode Student Management System 1.0 in the file /ramonsys/soa/index.php, through the ID argument. The record describes remote exploitation and states that a public exploit is available, and NVD assigns a CVSS 3.1 base score of 9.8. CISA KEV does not list this CVE, and no confirmed exploitation appears in the sources consulted.

CVE-2026-24302 is an improper access control weakness in Microsoft Azure Arc that, according to the record, lets an unauthorized attacker over the network elevate privileges. NVD rates it critical with a CVSS 3.1 base score of 9.8, while the CNA score in the record is 8.6. The sources consulted show no confirmed exploitation, and the record does not list affected or fixed versions.

A remotely initiable improper access control issue affects WeKan up to version 8.20 in its Attachment Migration component. The record states that version 8.21 resolves the issue and links a patch commit. The NVD assigns a CVSS 3.1 base score of 9.8, and no confirmed exploitation appears in the sources consulted.

Nexa Blocks, a WordPress plugin by wpdive, contains a deserialization of untrusted data weakness (CWE-502) that allows object injection. The CNA, Patchstack, rates it Critical with a CVSS 3.1 base score of 9.8, and the record describes affected versions up to and including 1.1.1. No fixed version and no confirmed exploitation appear in the sources consulted.

CVE-2026-1496 is a critical authentication bypass in Coverity Connect, caused by a missing error handler in the authentication logic used by command line tooling. According to the record, an attacker who knows or guesses a valid username could use a crafted HTTP request to the /token endpoint to assume that user's roles and privileges. No confirmed exploitation appears in the sources consulted, and the record does not list affected or fixed versions.