Analysis

CVE-2026-1632 affects MOMA Seismic Station version v2.4.2520 and prior, where the web management interface does not require authentication. According to the record, an unauthenticated attacker could modify configuration, acquire device data or remotely reset the device. The record reports a CVSS 3.1 base score of 9.1 (critical) and a CVSS 4.0 score of 9.3, both from CISA ICS-CERT.

Rclone versions from 1.46.0 up to, but not including, 1.74.3 are affected when the rcd --rc-serve service is enabled, because it accepts unauthenticated GET and HEAD requests that can trigger command execution during backend initialization. The record rates the issue critical, with CVSS 3.1 base score 9.8 from the CNA, and states it is fixed in 1.74.3. No confirmed exploitation appears in the sources consulted.

The Linux kernel netfilter component nfnetlink_osf has an out-of-bounds read (CWE-125) during TCP option matching for OS fingerprints. A shared parsing pointer was not restored between fingerprint checks, so later checks could read invalid data and fail. The CNA-supplied CVSS 3.1 score is 9.1 (critical), and the record lists no KEV entry or confirmed exploitation.

A use-after-free (CWE-416) in the mtk_eth_soc Ethernet driver of the Linux kernel can occur when a metadata dst is freed immediately instead of after the RCU grace period. The CNA-assigned CVSS 3.1 base score is 9.8 (Critical), and the record links five stable-tree patch commits. The sources consulted show no confirmed exploitation.

A logic error in the Linux kernel's tegra124-emc memory driver reversed the check for whether the DLL is enabled in the EMRS register. The upstream stable commits correct this condition in several kernel branches. The CNA rates the record 9.8 critical, but the record gives no impact detail that explains that score.

CVE-2026-46752 is a heap-based buffer overflow (CWE-122) in the cjson library used through Lua scripting in Apache Kvrocks. The record states that versions from 2.0.4 through 2.15.0 are affected and recommends upgrading to 2.16.0. The record rates it critical with a CVSS 4.0 base score of 10, and no confirmed exploitation appears in the sources consulted.

The Linux kernel GFS2 code calls log flushing routines from gfs2_logd() without holding sdp->sd_log_flush_lock, which those routines need to exclude concurrent transactions. Upstream commits add a non-locking __gfs2_log_flush() helper and make gfs2_logd() take the lock before the flush calls. The CNA scored the issue 9.8 (critical) under CVSS 3.1, and no confirmed exploitation appears in the sources consulted.

PEAR Pearweb versions before 1.33.0 contain a SQL injection flaw in category deletion, where a category id can be used to inject SQL. The record states the issue is patched in 1.33.0, and NVD rates it Critical with a CVSS 3.1 base score of 9.8. No confirmed exploitation appears in the sources consulted.

CVE-2026-53175 is a use-after-free (CWE-416) in the Linux kernel's inet fragment reassembly code. Incomplete fragment queues flushed during network namespace teardown keep pointers to freed buffers, which a late-resuming fragment can dereference. The CNA scores it 9.8 (critical) under CVSS 3.1, and the record shows no confirmed exploitation.

concurrent-ruby versions before 1.3.7 let any thread release a write lock held by another thread in Concurrent::ReadWriteLock, and release_read_lock can drive the shared counter below zero. The record rates it critical with CVSS 3.1 9.8 from NVD and 2.1 under CVSS 4.0 from GitHub. No confirmed exploitation appears in the sources consulted, and the fix is available in 1.3.7.

An SQL injection weakness (CWE-89) affects Martcode Software Inc. Delta Course Automation through 04022026, as reported in a record published by the Turkish CNA USOM. The CNA assigned a CVSS 3.1 base score of 9.8, but the record lists no affected or fixed version details, and the vendor did not respond to early disclosure.

CVE-2026-53006 is a use-after-free flaw in the IPv6 ICMPv6 receive path of the Linux kernel, classified as CWE-416. The CNA rates it 9.8 (CVSS 3.1, Critical), and the record lists fixes across several stable kernel branches and Red Hat Enterprise Linux releases. The record shows no KEV listing and no confirmed exploitation in the sources consulted.

CVE-2026-53055 is a use-after-free flaw (CWE-416) in the HiSilicon SEC2 crypto driver of the Linux kernel. According to the record, hardware can free a request structure before the transmission routine finishes using it, and the fix replaces that request reference with the qp_ctx context memory. The record gives a CVSS 3.1 base score of 9.8 and links stable-kernel fix commits for the affected version ranges.

CVE-2025-69981 affects Frangoteam FUXA version 1.2.7 and is classified as Unrestricted Upload of File with Dangerous Type (CWE-434). The /api/upload endpoint lacks authentication, so according to the record an unauthenticated remote attacker could upload arbitrary files, including attempts to overwrite the SQLite user database or to upload scripts. NVD rates it 9.8 (critical) under CVSS 3.1, and no fixed version is listed in the sources consulted.

CVE-2026-1341 affects the Avation Light Engine Pro, whose configuration and control interface is exposed without authentication or access control. The CNA record shows a CVSS 4.0 score of 9.3 (critical) and maps the weakness to CWE-306. The available record does not list affected versions, fixed versions, or inclusion in the CISA KEV catalog.