Analysis

CVE-2026-74878 affects openssl_encrypt versions before 1.4.0, where the TOTP brute-force protection uses an in-memory rate limiter. That limiter is not shared across workers and is lost on server restart, so the protection can be bypassed. VulnCheck rates it CVSS 3.1 9.8 (Critical), and the record reports no confirmed exploitation.

A SQL injection flaw (CWE-89) in the reset.php file of itsourcecode Leave Management System 1.0 allows a remote party to manipulate the employid argument. NVD rates it critical with a CVSS 3.1 score of 9.8, while several VulDB and CNA scores are lower. The record lists no fixed version and describes the exploit as publicly available.

CVE-2025-40552 is a critical authentication bypass in SolarWinds Web Help Desk. According to the record, an attacker could reach actions and methods that should be protected by authentication. The CVSS 3.1 base score of 9.8 is attributed to the CNA, and the listed affected range is versions before 2026.1. The record does not show KEV listing, and no confirmed exploitation appears in the sources consulted.

Jahlives openssl_encrypt versions before 1.4.0 are described as configuring CORS with a wildcard allowed origin and credentials enabled. According to the record, this can let malicious websites make authenticated cross-origin requests to the API on behalf of visiting users. NVD rates it critical at 9.3 under CVSS 3.1, and the record shows it is not listed in CISA KEV.

CVE-2026-24874 is a type confusion weakness (CWE-843) in the xray-monolith project by themrdemonized, affecting versions before 2025.12.30. NVD and the CNA both list a CVSS 3.1 score of 9.1 (critical), with a network attack vector and no privileges or user interaction required according to the vector. The CISA KEV catalog does not list it, no confirmed exploitation appears in the sources consulted, and the referenced pull request is the listed patch.

CVE-2025-69559 describes a file upload weakness (CWE-434) in admin_add.php of code-projects Computer Book Store 1.0, scored 9.8 Critical under CVSS 3.1 in the record. The record lists no fixed version and CISA KEV does not list the CVE. Defenders should restrict access to administrative functions and validate uploads while awaiting an authoritative fix.

CVE-2025-61140 describes a Prototype Pollution weakness (CWE-1321) in the value function of lib/index.js in jsonpath version 1.1.1. The NVD record carries a CVSS 3.1 base score of 9.8 and a critical severity label. No confirmed exploitation appears in the sources consulted, and the record lists no fixed version.

CVE-2026-24770 is a critical Zip Slip (CWE-22) path traversal vulnerability in the MinerU parser of Infiniflow RAGFlow, affecting version 0.23.1 and possibly earlier. According to the record, a malicious ZIP archive can lead to arbitrary file overwrite on the server and potentially remote code execution. A patch is referenced in commit 64c75d558e4a17a4a48953b4c201526431d8338f, and CISA KEV does not list this CVE.

CVE-2026-52914 affects the batman-adv module of the Linux kernel, where the accumulated payload length of queued fragments can be truncated during updates. According to the record, this can let malformed fragment chains bypass validation and cause a local denial of service, and the record assigns a CVSS 3.1 base score of 9.8 with CWE-787. No confirmed exploitation appears in the sources consulted, and the kernel stable commits listed in the record are the primary remediation path.

A buffer overflow in the /dbsrv.asp component of D-Link DI-7001 MINI 24.04.18B1 is recorded as remotely triggerable, with an NVD CVSS 3.1 base score of 9.8. The record states that an exploit has been publicly disclosed, but the vulnerability is not listed in the CISA KEV catalog. No fixed version appears in the consulted data, so exposure should be restricted and vendor guidance checked.

A SQL injection flaw in the Username argument of /admin/login.php in Campcodes Advanced Online Voting Management System 1.0 can be triggered remotely. NVD rates it 9.8 critical under CVSS 3.1, while VulDB scores in the record vary. The exploit is publicly disclosed, but the record does not show KEV listing or confirmed exploitation in the wild.

CVE-2026-105278 affects the published Docker image of Grid Protection Alliance openPDC, which ships with a fixed administrative credential that is not forced to change on first use. The record scores it critical (CVSS 3.1 9.8), and it is classified as CWE-798 (Use of Hard-coded Credentials). No confirmed exploitation appears in the sources consulted, and the record does not list a specific fixed version.

CVE-2020-36961 describes a stack-based buffer overflow in the exception handling of 10-Strike Network Inventory Explorer 8.65, which the record says can allow remote attackers to execute arbitrary code. The record reports a CVSS 3.1 base score of 9.8 (critical) from VulnCheck, but lists no affected or fixed versions and no KEV or EPSS data. Organizations running this product should verify their version and apply vendor updates when they can confirm them.

The Snow Monkey Forms plugin for WordPress has a path validation flaw in its 'generate_user_dirpath' function that allows unauthenticated attackers to delete arbitrary files on the server. The CNA rates it 9.8 (Critical) under CVSS 3.1, and the record notes that deleting critical files such as wp-config.php could lead to remote code execution. No confirmed exploitation appears in the sources consulted.

A SQL injection weakness (CWE-89) was reported in the transaction.php file of code-projects Web-Based Inventory and POS System 1.0. It is triggered through the shopid argument and can be reached remotely. The NVD rates it critical with a CVSS 3.1 base score of 9.8, and the record states that a public exploit has been disclosed, while no fixed version is listed and the CVE is not in CISA KEV.