Analysis

Opensolution Quick.Cart is affected by session fixation (CWE-384): the session identifier can be set before authentication and stays the same after login, which can let an attacker hijack an authenticated session. The CNA CERT.PL reports that only version 6.7 was tested and confirmed vulnerable, and the vendor did not provide a vulnerable version range. NVD scores the issue 9.8 under CVSS 3.1, while CERT.PL scores it 4.8 under CVSS 4.0.

CVE-2026-32539 is a blind SQL injection vulnerability (CWE-89) in PublishPress Revisions, a WordPress plugin, as described in the record for versions up to and including 3.7.23. The CNA Patchstack assigned a CVSS 3.1 base score of 9.3 (critical), and the record lists no confirmed exploitation. No fixed version is listed in the sources consulted.

CVE-2026-1963 affects WeKan up to version 8.20 and is classified as an improper access control issue in the Attachment Storage component. The record states that the issue can be triggered remotely and that upgrading to version 8.21 mitigates it. NVD scores it 9.8 (critical) under CVSS 3.1, the CNA scores are lower, and no confirmed exploitation appears in the sources consulted.

CVE-2026-3356 is an authentication bypass in the MS27102A Remote Spectrum Monitor that lets unauthorized users reach and change its management interface. The record states the device has no way to enable or configure authentication, and ICS-CERT rates it 9.3 critical under CVSS 4.0. No fix or affected version list is provided, and the issue is not listed in CISA KEV.

CVE-2026-55413 affects ToolJet versions prior to 3.20.178-lts. An authenticated user with the builder role can overwrite a globally shared marketplace plugin with JavaScript that runs server-side. The record rates it critical (CVSS 4.0 score 9.4), and no confirmed exploitation appears in the sources consulted.

A critical, unauthenticated stack-based buffer overflow in the vlsvr component of GeoVision GV-LPC2011 and GV-LPC2211 (V1.12 and earlier) can be triggered remotely through crafted login data. The CNA assigned CVSS 3.1 base score 9.8. The record does not list this CVE in CISA KEV, and no confirmed exploitation appears in the sources consulted.

CVE-2026-2011 is an SQL injection (CWE-89) in itsourcecode Student Management System version 1.0, triggered by manipulation of the ID argument and reachable remotely. NVD scores it 9.8 under CVSS 3.1, and the description states that a public exploit exists. The record shows no fixed version and no KEV listing.

Pinger 1.0 is affected by an OS command injection flaw (CWE-78) that the record says allows remote code execution through the ping and socket parameters. The CVSS 3.1 base score of 9.8 (critical) comes from VulnCheck, and CISA KEV does not list this CVE. The record has no structured affected or fixed version data, so remediation status is unknown.

CVE-2026-32512 describes a deserialization of untrusted data weakness (CWE-502) in the Pelicula theme by Edge-Themes, classified as object injection. The record states that versions below 1.10 are affected, and the CNA Patchstack assigned a CVSS 3.1 base score of 9.8 (critical). No confirmed exploitation appears in the sources consulted.

CVE-2026-57880 is a critical stack-based buffer overflow in the ssvr component of GeoVision GV-LPC2011 and GV-LPC2211 devices, version V1.12 and earlier. According to the record, it can be triggered without authentication by an RTSP request with overly long Digest authentication fields. The CNA rates it 9.8 (CVSS 3.1), and no confirmed exploitation appears in the sources consulted.

CVE-2026-6094 is a heap buffer overread in the wc_PKCS7_DecodeEnvelopedData routine of wolfSSL when it parses crafted PKCS7 EnvelopedData. The record states that this could theoretically be triggered by attacker-supplied data delivered via S/MIME or CMS. NVD scores it 9.1 under CVSS 3.1, while the CNA lists 6.3 under CVSS 4.0, and no KEV listing or confirmed exploitation appears in the sources consulted.

Anysphere Cursor versions before 3.0 can write files outside the workspace when path canonicalization fails, because the agent falls back to the original path without approval. NVD assigns CVSS 3.1 9.8 and the GitHub CNA assigns CVSS 4.0 9.3, and the record describes possible non-sandboxed remote code execution. The record states the fix is in 3.0 and does not list the CVE in CISA KEV.

A code injection vulnerability (CWE-94) affects the Widget Wrangler WordPress plugin by Jonathan Daggerhart, according to the record for versions up to and including 2.3.9. The CNA audit@patchstack.com scored it 9.1 (critical) under CVSS 3.1. No confirmed exploitation appears in the sources consulted, and no fixed version is listed in the record.

CVE-2026-32519 affects the Bit SMTP plugin for WordPress from Bit Apps and is classified as Incorrect Privilege Assignment (CWE-266), which allows privilege escalation. Patchstack and CISA-ADP report a CVSS 3.1 base score of 9.0 (Critical) for a network-reachable attack requiring no privileges or user interaction. No fixed version or confirmed exploitation appears in the record.

AutoGPT Platform versions before autogpt-platform-beta-v0.6.34 contain a server-side request forgery (SSRF) flaw in SendDiscordFileBlock, where a supplied URL is fetched without filtering. The advisory states the issue is patched in v0.6.34, and NVD scores it 9.8 (CVSS 3.1, critical). No confirmed exploitation appears in the sources consulted, and the CVE is not listed in CISA KEV.