Analysis

RIOT, an open-source operating system for IoT and embedded microcontrollers, has multiple out-of-bounds read flaws in its 6LoWPAN stack in version 2025.10 and earlier. An unauthenticated user able to send packets may read adjacent memory or crash a vulnerable device. No known patch existed at publication, and the record does not list this CVE in CISA KEV.

A critical OS command injection flaw (CWE-78) in the ping action of the Rapid7 InsightConnect Ping Plugin on Linux allows remote attackers to run arbitrary OS commands through the host parameter. NVD scores it 9.8 (CVSS 3.1), while the CNA Rapid7 scores it 7.7. The record lists versions below 1.0.4 as affected, and no confirmed exploitation appears in the sources consulted.

CVE-2026-25505 affects Bambuddy versions before 0.1.7, a self-hosted print archive for Bambu Lab 3D printers. The record describes a hardcoded secret used to sign JWTs and API routes that do not check authentication, with a CVSS 3.1 base score of 9.8 from the CNA. The issue is fixed in 0.1.7, and no confirmed exploitation appears in the sources consulted.

CVE-2026-39955 is a critical SQL injection flaw in Cacti versions 1.2.30 and prior, reachable before authentication through an unanchored FILTER_VALIDATE_REGEXP check in graph_view.php. The vendor fixed it in version 1.2.31, and the record reports a CVSS 3.1 base score of 9.8. No confirmed exploitation appears in the sources consulted, and the CVE is not listed in CISA KEV.

CVE-2026-25236 affects the Pearweb component of the PEAR PHP framework and distribution system. Prior to version 1.33.0, karma queries use unsafe literal substitution for an IN (...) list, creating a SQL injection risk. The issue is described as patched in version 1.33.0, and no confirmed exploitation appears in the sources consulted.

CVE-2026-53221 is a flaw in the Linux kernel ip6_vti driver, where the fallback search in vti6_tnl_lookup() does not confirm that a candidate tunnel really uses a wildcard address. The CNA rates it critical with a CVSS 3.1 base score of 9.8, and the record lists stable-branch fix commits. No confirmed exploitation appears in the sources consulted, and the CVE is not listed in CISA KEV.

PEAR Pearweb versions before 1.33.0 contain a SQL injection flaw in bug subscription deletion that can be triggered through a crafted email value. NVD scores the issue 9.8 (critical) under CVSS 3.1, and the record states it is patched in version 1.33.0. The record shows no KEV listing and no confirmed exploitation in the sources consulted.

CVE-2026-53228 is a critical issue in the Linux kernel SIT tunnel path for IPv6 over IPv4, rated 9.8 by the CNA under CVSS 3.1. The transmit function keeps using an inner IPv6 header pointer after a helper that can move the packet head, which may lead to reads from freed memory. Stable kernel fixes are referenced in the record, and no confirmed active exploitation appears in the sources consulted.

CVE-2020-37110 describes an SQL injection flaw in 60CycleCMS 2.5.2, located in news.php and common/lib.php, where unvalidated input can alter database queries. The NVD entry rates it critical with a CVSS 3.1 base score of 9.8, and VulnCheck lists a CVSS 4.0 score of 8.8. No confirmed exploitation appears in the sources consulted, and the CISA KEV catalog does not list this CVE.

SunFounder Pironman Dashboard (pm_dashboard) version 1.3.13 and prior contain a path traversal flaw in log file API endpoints that lets unauthenticated remote attackers read and delete arbitrary files. VulnCheck scores it 9.3 under CVSS 4.0. The CISA KEV catalog does not list it in this record, and no confirmed exploitation appears in the sources consulted.

CVE-2025-15030 affects the User Profile Builder plugin for WordPress before version 3.15.2. The plugin's password reset process is flawed, so an unauthenticated attacker who knows a username can reset that user's password, including administrator accounts. The CVSS 3.1 base score in the record is 9.8 (critical), and no confirmed exploitation appears in the sources consulted.

CVE-2026-24857 is a heap buffer overflow in the embedded unrar code of Simsong bulk_extractor, starting with version 1.4. A crafted RAR archive inside a disk image can trigger an out-of-bounds write, and the record notes potential for remote code execution. The record reports no known patch at publication, and no confirmed exploitation appears in the sources consulted.

Ajenti 2.1.36 is associated with a post-authenticated OS command injection flaw (CWE-78) that can let a logged-in user run arbitrary commands on the host. The record reports a CVSS 3.1 base score of 9.8 (critical) and a CVSS 4.0 score of 8.7, both from VulnCheck. The CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

A public CVE record reports an SQL injection flaw (CWE-89) in Jishenghua jshERP up to 3.6, reached through the barCodes argument of an Excel item import function. The record states the exploit is publicly disclosed and the issue can be triggered remotely, and NVD scores it 9.8 (critical). No fixed version is listed, and the project had not responded at the time of the record.

CVE-2026-22806 affects vCluster Platform and allows a limited-scope access key to reach resources outside its defined scope, classified as Incorrect Authorization (CWE-863). The description states that access remains capped at what the key owner can reach, and it names fixed releases for each maintained branch. Upgrading is the primary remediation, while scope reviews and limited automation users are interim measures.