Analysis

CVE-2026-32520 is an incorrect privilege assignment flaw (CWE-266) in the RewardsWP WordPress plugin from Andrew Munro / AffiliateWP, which the CNA says allows privilege escalation in versions through 1.0.4. The CNA scored it 9.8 (critical) under CVSS 3.1, but the record does not state a fixed version and the lower bound of the affected range is listed as n/a. No confirmed active exploitation appears in the sources consulted.

A deserialization of untrusted data flaw (CWE-502) in the ThemeREX Love Story WordPress theme allows Object Injection, according to the CVE record. The CNA rates it critical with a CVSS 3.1 base score of 9.8, and the affected range runs through 1.3.12. The record lists no structured fixed version and no CISA KEV listing.

CVE-2026-13028 is a use-after-free flaw in the WebGL component of Google Chrome on Android, classified as CWE-416. The record describes a remote attacker potentially achieving a sandbox escape through a crafted HTML page, with a CVSS 3.1 base score of 9.6. Chrome on Android should be updated to 149.0.7827.197 or later, and no confirmed exploitation appears in the sources consulted.

CloudMe 1.11.2 is affected by a classic buffer overflow (CWE-120) that, according to the record, can be triggered by crafted network packets sent to the service on port 8888 to execute arbitrary code. VulnCheck, the CNA, scores it 9.8 under CVSS 3.1 and 8.6 under CVSS 4.0. No KEV listing or confirmed exploitation appears in the sources consulted, and the record provides no affected or fixed version data.

SiYuan versions prior to 3.7.0 mishandle CSS snippet content, which can break out of its style container and run JavaScript in the renderer. The advisory states that on Electron desktop builds this can extend to host code execution, and that synced snippets can affect other devices. The advisory states the issue is fixed in 3.7.0.

CVE-2020-37066 is a stack-based buffer overflow in GoldWave 5.70 that the record says can be triggered through the File Open URL dialog when a specially crafted text file is opened. The CNA VulnCheck scores it 9.8 (critical) under CVSS 3.1 and 8.4 under CVSS 4.0. CISA KEV does not list it, and the record contains no affected or fixed version data.

A flaw in the Linux kernel ib_srp initiator lets a malicious or compromised SRP target trigger a read past the receive buffer when processing SRP_RSP sense data. The record gives a CNA CVSS 3.1 base score of 9.1 and lists affected kernel ranges with upstream stable fixes. No confirmed exploitation appears in the sources consulted.

The ksmbd SMB server component of the Linux kernel can free an AEAD crypto request while an asynchronous hardware engine such as the Qualcomm Crypto Engine still uses it, causing a use-after-free (CWE-416). The record gives a CVSS 3.1 base score of 9.8 from the CNA, and several stable kernel fix commits are referenced. No confirmed exploitation appears in the sources consulted, and the CVE is not listed in CISA KEV.

CVE-2026-41566 is a vulnerability in Apache Kvrocks classified as improper handling of insufficient permissions or privileges (CWE-280). The CNA reports that version 2.8.0 is affected and recommends upgrading to version 2.16.0, which fixes the issue. The CNA-supplied CVSS 4.0 base score is 9.4 (critical), and no confirmed exploitation appears in the sources consulted.

The Linux kernel ocfs2 distributed lock manager uses the qr_numregions field of incoming DLM_QUERY_REGION messages as loop bounds without checking it first. According to the record, a crafted message can cause out-of-bounds memory access, and the CNA rates it Critical with CVSS 3.1 score 9.1. The record lists stable kernel fix commits, and no confirmed exploitation appears in the sources consulted.

Cacti versions 1.2.30 and earlier contain an SQL injection flaw (CWE-89) in the rfilter parameter handled by graph_view.php. When guest graph viewing is enabled, the flaw can be reached without authentication. The issue is fixed in version 1.2.31.

Gogs versions before 0.14.3 accept organization names containing path traversal sequences, which can cause repository data to be written to arbitrary filesystem locations. The record states this can be used to overwrite repository hook configuration and achieve remote code execution, and that the issue is fixed in 0.14.3. The CVSS 3.1 base score of 10.0 is reported as critical by the CNA.

A logic flaw in the roadmap role check of PEAR Pearweb, prior to version 1.33.0, lets users who are not lead maintainers create, update, or delete roadmaps. The issue is fixed in version 1.33.0. The record lists a critical CVSS 3.1 base score of 9.1 from NVD, and no confirmed exploitation appears in the sources consulted.

Appsmith versions before 2.1 contain a server-side request forgery (SSRF) weakness in the outbound host filter used by the REST API and GraphQL datasource plugins. The filter relies on an exact-match string denylist, so the broader address-class checks that exist on another code path (used by SMTP) are not applied to HTTP requests. The description states the issue is fixed in 2.1, and NVD lists a CVSS 3.1 base score of 9.1 (critical).

SiYuan, an open-source personal knowledge management system, is affected by a stored cross-site scripting flaw in the asset cell renderer of its Attribute View (database) feature. According to the record, the flaw can escalate to remote code execution in the Electron desktop client, and it is fixed in version 3.7.0. The GitHub CNA reports a CVSS 3.1 score of 9.9 (critical).