Analysis

CVE-2026-25049 affects n8n, an open source workflow automation platform, in versions before 1.123.17 and in the 2.x line before 2.5.2. According to the record, an authenticated user allowed to create or modify workflows could use crafted expressions in workflow parameters to trigger unintended system command execution on the host. NVD rates it critical with CVSS 3.1 score 9.9, and the issue is fixed in 1.123.17 and 2.5.2.

Cacti versions 1.2.30 and prior pass the rfilter request variable into an RLIKE SQL clause without sanitization, which is a SQL injection weakness (CWE-89). The record states it is reachable without authentication on installations where guest graph viewing is enabled, and it is rated critical with a CVSS 3.1 base score of 9.8. The issue is fixed in version 1.2.31.

CVE-2026-53151 is a flaw in the Linux kernel AF_RXRPC ACK parser, where the SACK table was read from a received buffer that may not be flat or safely accessible. The upstream fix copies the SACK table into a separate buffer before parsing. The record shows a CNA-assigned CVSS 3.1 base score of 9.8, is not listed in CISA KEV, and reports no confirmed exploitation in the sources consulted.

CVE-2026-8665 is an OS command injection flaw in the TR action of the Rapid7 InsightConnect Translate Plugin on Linux, published with Rapid7 as the CNA. The record states that remote attackers can run arbitrary OS commands through the text or expression parameters because input is not sanitized sufficiently before shell commands are built. NVD lists a CVSS 3.1 base score of 9.8 and the CNA lists 7.7, and no confirmed exploitation appears in the sources consulted.

A netfilter flaw in the Linux kernel allows several modules, including xt_mac, ip6t_eui64, the ipset MAC-based types and nf_log_syslog, to read the Ethernet header without first confirming that the packet belongs to an Ethernet device and has a valid MAC header. The record assigns a CNA CVSS 3.1 score of 9.4 (critical) and lists seven stable-tree patches. No confirmed exploitation appears in the sources consulted.

The Synectix LAN 232 TRIO 3-Port serial to ethernet adapter exposes its web management interface without requiring authentication, as described in CVE-2026-1633 (CWE-306). According to the record, an unauthenticated user could modify critical device settings or factory reset the device. The record reports a CVSS 3.1 base score of 10 and a CVSS 4.0 score of 10 from ICS-CERT, with no confirmed exploitation in the sources consulted.

CVE-2026-25052 is a critical flaw in n8n, an open source workflow automation platform, affecting versions before 1.123.18 and versions from 2.0.0 up to but not including 2.5.0. According to the record, authenticated users who can create or modify workflows may read sensitive files from the host system, potentially exposing configuration data and credentials. The vendor reports the issue is fixed in 1.123.18 and 2.5.0.

CVE-2025-69983 affects FUXA 1.2.7, where importing a project file can lead to remote code execution because user-supplied scripts are not properly sanitized or sandboxed. NVD rates it critical with a CVSS 3.1 base score of 9.8. No KEV listing or confirmed exploitation appears in the sources consulted.

CVE-2025-10878 describes a SQL injection flaw in the login functionality of Fikir Odalari AdminPando 1.0.1, where the username and password parameters can be abused by unauthenticated attackers to bypass authentication. The record reports a critical CVSS 3.1 score of 10 and CWE-89, with possible full administrative access to the application. No confirmed exploitation appears in CISA KEV in the sources consulted.

CVE-2026-1813 is an unrestricted file upload flaw (CWE-434) in Bolo-solo up to version 2.6.4, affecting a function in the FreeMarker Template Handler component. NVD assigns a CVSS 3.1 base score of 9.8 (critical), while the CNA VulDB scores are lower, and the record states that a public exploit exists. The project was reported through an issue and had not responded at the time of the record.

Gogs versions prior to 0.14.3 let authenticated users trigger command injection through a crafted branch name during the rebase-before-merging operation of a pull request, which the record says can lead to remote code execution. The record assigns a critical CVSS 3.1 base score of 9.9 and states the issue is fixed in 0.14.3. The CISA KEV catalog does not list this CVE in the record, and no confirmed exploitation appears in the sources consulted.

CVE-2026-39938 affects Cacti versions 1.2.30 and prior, which are described as vulnerable to unauthenticated local file inclusion through graph_theme and rrdtool IPC serialization hardening. GitHub rates the issue Critical with a CVSS 3.1 base score of 9.8, and the vendor states it is resolved in version 1.2.31. No confirmed exploitation appears in the sources consulted, and the CVE is not listed in CISA KEV.

CVE-2026-55570 affects SiYuan versions prior to 3.7.0, where untrusted package fields are not escaped in marketplace card markup. In the desktop client this DOM XSS can escalate to arbitrary OS command execution, and the record rates it critical with CVSS 3.1 score 9. Upgrading to 3.7.0 or later is the primary remediation, and no confirmed exploitation appears in the sources consulted.

SiYuan Note versions before 3.7.0 trust every chrome-extension:// origin with administrator privileges on the local kernel HTTP server. According to the record, the default desktop installation has an empty access authorization code, so any installed Chrome or Chromium extension could reach the admin API. The record states the issue is fixed in 3.7.0 and gives it a CVSS 4.0 base score of 9.2.

FOSSBilling versions 0.7.2 and prior contain an authentication bypass in a guest API endpoint meant for initial administrator setup. The endpoint stays reachable after an administrator exists, which can allow creation of a privileged admin account. GitHub rates it Critical with CVSS 4.0 9.3 and reports a fix in version 0.8.0.