Analysis

NLTK versions before 3.10.3 contain a remote code execution flaw in allowlisted pickle loaders that trust whole module namespaces instead of specific safe callables. The record rates it critical, with CVSS 3.1 score 9.8, and classifies it as CWE-502. It is not listed in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted.

ProxySQL versions 2.0.0 through 3.0.8 accept a forged PROXY protocol header on the MySQL frontend and use the spoofed source address for query routing and ACL decisions. With the default network setting, any peer that can reach the frontend port can claim a chosen client IP. The record identifies version 3.0.9 as the patched release.

CVE-2026-52931 is a critical flaw in the batman-adv tp_meter component of the Linux kernel, where ACK handling and session stop routines can read sender-only data while a node is acting as receiver. The record assigns CVSS 3.1 base score 9.8 with a network attack vector and no privileges or user interaction required. The upstream fix adds a role check that rejects non-sender states before that data is accessed, and no confirmed exploitation appears in the sources consulted.

A use-after-free flaw in the Linux kernel SCTP stack can occur when a Stale Cookie error rolls an association back to COOKIE_WAIT while queued data still references the old stream state. The record assigns a CNA CVSS 3.1 score of 9.8 and lists eight upstream fix commits. No confirmed exploitation appears in the sources consulted.

CVE-2026-48491 affects Traefik versions 3.7.0 up to 3.7.3, where the SNICheck domain-fronting protection does not apply wildcard TLS options to the HTTP Host header. According to the record, an unauthenticated client may reach a wildcard-protected backend without presenting a client certificate. The issue is fixed in 3.7.3, and no confirmed exploitation appears in the sources consulted.

CVE-2026-54307 is an incorrect authorization flaw (CWE-863) in the n8n workflow automation platform. A member-level user with Editor access to a shared workflow could reference credentials they do not own through certain public API endpoints, because ownership checks were only partially enforced. The advisory lists fixed releases 1.123.55, 2.25.7 and 2.26.2, and no confirmed exploitation appears in the sources consulted.

CVE-2026-11373 affects Net::Statsite::Client for Perl through version 1.1.0, a client for the statsite protocol. Newlines are not removed from metric names, and values are not sanitised for newlines, colons or pipes, which allows metric injection. The record rates it critical with CVSS 3.1 score 9.1, and no confirmed exploitation appears in the sources consulted.

CVE-2026-22264 affects Suricata, an open-source network IDS, IPS and NSM engine. An unsigned integer overflow can lead to a heap use-after-free when a single packet produces an excessive number of alerts, and versions 7.0.14 and 8.0.3 include a patch. No confirmed exploitation appears in the sources consulted.

CVE-2021-3711 is a buffer overflow in the SM2 decryption code of OpenSSL. The buffer size calculated during the first EVP_PKEY_decrypt() call can be smaller than the size needed by the second call, which may let attacker-chosen data overflow the buffer by up to 62 bytes. The NVD record gives it a CVSS 3.1 score of 9.8 (critical), and the fix is in OpenSSL 1.1.1l. The CVE is not listed in CISA KEV and no confirmed exploitation appears in the sources consulted.

Suricata, a network IDS, IPS and NSM engine, is affected by CVE-2026-22262, a stack overflow in the code that saves datasets when the data is too large. The record lists versions earlier than 7.0.14 and versions from 8.0.0 up to but not including 8.0.3 as affected. Patched versions are 8.0.3 and 7.0.14, and a workaround is to avoid rules that use the dataset save or state options.

The record describes an SQL injection flaw in the Password parameter of /ExLogin.php in code-projects Mobile Shop Management System 1.0, classified as CWE-89 and scored 9.8 (critical) under CVSS 3.1. The record shows no KEV listing, and no confirmed exploitation in the wild appears in the sources consulted. The product name in the affected list differs from the vendor name in the description, so this should be verified.

A SQL injection flaw has been reported in PHPGurukul Beauty Parlour Management System version 1.1, in the /admin/invoices.php file through the delid argument. The record describes the issue as remotely exploitable and states that an exploit has been publicly released. NVD lists a CVSS 3.1 base score of 9.8 (critical), while no confirmed exploitation in the wild appears in the sources consulted.

CVE-2026-24785 affects Clatter, a Rust implementation of the Noise protocol framework with post-quantum support, in versions before 2.2.0. The library accepted post-quantum handshake patterns that break the PSK validity rule, which can lead to PSK-derived keys being used for encryption without proper ephemeral randomness. The issue is fixed in v2.2.0, which adds runtime checks, and no confirmed active exploitation appears in the sources consulted.

CVE-2026-56237 affects Capgo versions before 12.128.2 and involves broken authentication in the API key generation mechanism. The backend does not verify that generated keys are securely created and bound to the authenticated user. VulnCheck reports a critical CVSS 3.1 score of 9.1, and no confirmed exploitation appears in the sources consulted.

Grav versions before 2.0.14 fail to protect the access field of the core group blueprint with the required super-admin restriction. According to the record, a delegated user with admin.users rights can save a group with elevated access and become super-admin, which also grants scheduler and Twig evaluation capabilities. No confirmed active exploitation appears in the sources consulted.