Analysis

CVE-2026-9054 affects the 9front operating system and can be triggered by tcp, il, rudp or gre packets whose length is smaller than the header size, causing a kernel panic. The CVSS 4.0 score of 9.2 is provided by both listed providers, but the record shows no KEV listing and a low EPSS probability. The available commit references point to mitigation work, and administrators should check whether their systems include those changes.

CVE-2026-42740 is a critical blind SQL injection flaw (CWE-89) in the Tainacan plugin for WordPress, as reported by Patchstack. The record lists affected versions up to and including 1.0.3 and gives a CVSS 3.1 base score of 9.3. The sources consulted show no confirmed exploitation, and the record lists no fixed version.

CVE-2026-48700 affects LXQt PCManFM-Qt. When a regular file path is passed as a URI to the org.freedesktop.FileManager1.ShowFolders D-Bus method, the application hands the file to another program chosen by file type, without user confirmation. MITRE scores it 9.3 under CVSS 4.0, but the record lists no fixed version, the CVE is not in CISA KEV, and the record notes the behavior complies with the applicable specification.

CVE-2026-9475 is a command injection weakness (CWE-77) reported in the Web Management Interface of the Totolink A8000RU, firmware 7.1cu.643_b20200521. The record describes the flaw in the setIpQosRules function reached through /cgi-bin/cstecgi.cgi and states that the exploit has been publicly disclosed. The record shows no KEV listing and no confirmed active exploitation, and it provides no fixed version.

CVE-2026-9387 is a command injection flaw in the Web Management Interface of Totolink A8000RU firmware 7.1cu.643_b20200521, reached through the setUpgradeFW function of /cgi-bin/cstecgi.cgi. The record states that the resetFlags argument can be manipulated to run OS commands and that the attack can be launched remotely. The CNA reports a CVSS 3.1 score of 9.8 and notes that the exploit has been publicly released, but CISA KEV does not list it.

libbabl 0.1.62, a library from the GEGL project, has a broken double free detection mechanism tracked as CWE-415, which can let an attacker bypass memory safety checks. VulnCheck publishes a CVSS 3.1 base score of 9.8 (Critical) and a CVSS 4.0 score of 9.3 for this CVE. The record lists no fixed version and does not list the CVE in CISA KEV.

CVE-2026-4883 affects the Piotnet Forms plugin for WordPress in all versions up to and including 2.1.40. Missing file type validation in the form handling function lets unauthenticated users upload arbitrary files, which may enable remote code execution, but only on sites where a file field is present in a form. Wordfence rates it 9.8 (Critical) under CVSS 3.1, and the sources consulted report no confirmed exploitation.

CVE-2026-9406 is an OS command injection weakness (CWE-77) in the Web Management Interface of the Totolink A8000RU, version 7.1cu.643_b20200521. The record describes it as remotely exploitable, with CVSS 3.1 base score 9.8 from VulDB, and states that an exploit has been made public. No vendor fix is listed in the sources consulted, so affected devices need interim hardening and isolation.

CVE-2018-25335 describes an arbitrary file upload flaw in the Peugeot Music WordPress plugin version 1.0, which VulnCheck rates as critical with a CVSS 3.1 base score of 9.8. According to the record, unauthenticated requests can place files with arbitrary extensions in the uploads directory, where they may be executed. CISA KEV does not list this CVE and the sources consulted show no confirmed exploitation.

LibJWT versions 3.0.0 through 3.3.2 can accept an RSA JWK without an alg parameter as the key for HMAC-based JWT verification, which allows token forgery in the OpenSSL backend. GitHub's CNA field assigns a 9.1 score under CVSS 4.0, and the fix is available in 3.3.3. The CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

MCP Calculate Server, a calculation service built on the MCP protocol and SymPy, uses eval() on mathematical expressions without proper input sanitization before version 0.1.1. The record classifies this as code injection leading to remote code execution, with a CNA-provided CVSS 3.1 base score of 9.8 (critical). The issue is fixed in 0.1.1, and the record does not list exploitation in the wild.

CVE-2026-39531 is a blind SQL injection flaw (CWE-89) in the WP Directory Kit WordPress plugin, as described by the Patchstack CNA. The record assigns a CVSS 3.1 score of 9.3 (critical) and states that the issue affects versions through 1.5.0. No confirmed exploitation appears in the sources consulted, and the record contains no fixed-version data.

A code injection flaw (CWE-94) in jsonpickle 2.0.0 allows arbitrary Python code execution when untrusted JSON containing py/repr objects is deserialized. VulnCheck, the CNA, rates it CVSS 3.1 9.8 (critical). The record lists no fixed version and no CISA KEV listing.

The BookingPress Pro plugin for WordPress has an unrestricted file upload flaw (CWE-434) in its booking form validation function, affecting all versions up to and including 5.6. Wordfence rated it Critical with a CVSS 3.1 base score of 9.8, and the record says exploitation without authentication is possible only when a signature custom field is added to the booking form. The CVE is not listed in CISA KEV and the sources consulted do not show confirmed exploitation.

CVE-2026-42755 is a blind SQL injection (CWE-89) in the TableOn plugin (posts-table-filterable) for WordPress, affecting versions through 1.0.5.1 according to the record. Patchstack assigned a CVSS 3.1 base score of 9.3 (critical). The record lists no fixed version and no entry in CISA KEV.