Analysis

CVE-2025-7016 is an improper access control weakness (CWE-284) in Akinsoft QR Menu, published by Akın Software. The record describes it as allowing authentication abuse and says it affects versions before s1.05.12. NVD scores it 9.8 under CVSS 3.1, and no confirmed exploitation appears in the sources consulted.

CVE-2026-1535 describes an SQL injection issue in the code-projects Online Music Site 1.0, located in /Administrator/PHP/AdminReply.php through the ID argument. NVD rates it CVSS 3.1 9.8 (Critical), and the record states that a public exploit has been disclosed. The CISA KEV catalog does not list it, and the record provides no fixed version.

Plane versions before 1.4.0 follow HTTP redirects when delivering workspace webhooks and do not check the final destination, which enables server-side request forgery (SSRF). The record rates it critical with a CVSS 3.1 score of 9.9 and states the issue is fixed in 1.4.0. No CISA KEV listing and no confirmed exploitation appear in the sources consulted.

CVE-2026-1723 is an OS command injection weakness (CWE-78) in TOTOLINK X6000R firmware through V9.4.0cu.1498_B20250826. The record lists a CVSS 4.0 base score of 9.2 (critical) from Palo Alto Networks PSIRT, and the CVE is not listed in CISA KEV. The record contains no structured affected or fixed version data, so administrators should confirm exposure and available updates directly with the vendor.

A stack-based buffer overflow in the setIpQosRules interface of TOTOLINK A950RG firmware V4.1.2cu.5204_B20210112 is linked to insufficient length validation of the comment parameter. The record assigns a CVSS 3.1 base score of 9.8 (critical). No fixed version is listed, and no confirmed exploitation appears in the sources consulted.

CVE-2025-7964 affects Zigbee implementations where a malformed 802.15.4 MAC Data Request leads the Zigbee Coordinator to send a network leave request to a Zigbee Router. The router can then be stuck in a non-rejoinable state, and end devices may be unable to rejoin if no suitable parent is available. The CNA assigned a CVSS 4.0 base score of 9.2, and manual recommissioning is described as the recovery path.

A buffer overflow in Zortam Mp3 Media Studio 27.60 is reported to allow remote code execution through a crafted text file processed during library creation file selection. VulnCheck scores the issue 9.8 (critical) under CVSS 3.1, and the CVE is not listed in CISA KEV. The available sources identify no fixed version, so the immediate priorities are inventory, restricting untrusted files and checking the vendor for updates.

A SQL injection vulnerability has been reported in the add_expenses.php component of itsourcecode Society Management System 1.0, reachable through the detail argument. The record describes remote exploitation and a publicly disclosed exploit, but CISA KEV does not list it and no confirmed active exploitation appears in the sources consulted. The record provides no vendor patch or fixed version.

CVE-2026-1688 is an SQL injection flaw (CWE-89) in the Username argument of /admin/index.php in itsourcecode Directory Management System 1.0, which can be triggered remotely. NVD scores it CVSS 3.1 9.8 (Critical). The record notes a public exploit disclosure but no CISA KEV listing, and no vendor fix is identified.

CVE-2025-67856 is an incorrect authorization flaw in Moodle's badge awarding process, where incomplete role checks let badges be granted without proper verification. NVD rates it Critical with a CVSS 3.1 score of 9.8. The CISA KEV catalog does not list it, and no confirmed exploitation appears in the sources consulted.

CVE-2026-24054 affects Kata Containers versions prior to 3.26.0. When a container image is malformed or has no layers, containerd can bind-mount an empty snapshotter directory as the container rootfs, which the Kata runtime may treat as a block device and hotplug into the guest. The record describes possible host filesystem errors and a read-only host block device; NVD rates it critical (CVSS 3.1 score 10), and version 3.26.0 contains a patch.

NocoDB versions prior to 0.301.0 contain a stored cross-site scripting issue in attachment handling, where SVG files uploaded by authenticated users can run JavaScript in other users' browsers. The record rates it critical, with CVSS 3.1 score 9 from NVD and CVSS 4.0 score 8.5 from GitHub, and states that version 0.301.0 fixes it. No confirmed active exploitation appears in the sources consulted.

CVE-2026-52993 is a double-free (CWE-415) in the TIPC networking code of the Linux kernel, in tipc_buf_append(). The CNA rates it 9.8 (CVSS 3.1), and the record also lists a 7.0 score from another provider. The record lists affected kernel version ranges and stable-kernel fixes, and it does not list the CVE in CISA KEV.

A SQL injection weakness was reported in the txtsearch argument of /ramonsys/inquiry/index.php in itsourcecode School Management System 1.0. The NVD base score is 9.8 (CVSS 3.1) and the record states the attack can be launched remotely and that a public exploit exists. No confirmed exploitation in the wild appears in the sources consulted, and no fixed version is identified in the record.

A hostname validation weakness in the FinalDestination component of Discourse can allow bypassing SSRF protections under certain conditions, according to the record. NVD scores it critical at 9.9 (CVSS 3.1), and the record lists patched versions 3.5.4, 2025.11.2, 2025.12.1 and 2026.1.0 with no known workarounds. Administrators should upgrade to a patched release; no confirmed exploitation appears in the sources consulted.