Analysis

OpenMage Magento-lts versions prior to 20.18.0 generate XML-RPC and SOAP API session IDs with a time-based MD5 construction instead of a cryptographically secure generator, classified as CWE-330. The CNA rated the issue critical with a CVSS 4.0 base score of 9.3, and the record states it is fixed in 20.18.0. No confirmed exploitation appears in the sources consulted.

CVE-2026-9457 is an OS command injection flaw in the Web Management Interface of Totolink A8000RU firmware 7.1cu.643_b20200521, reached through the UploadFirmwareFile function of /cgi-bin/cstecgi.cgi. The CNA VulDB rates it critical with CVSS 3.1 9.8 and describes remote exploitation with a publicly disclosed exploit. The record lists no fixed version or affected range, and the CVE is not in CISA KEV.

A command injection flaw (CWE-77) has been reported in the setLanguageCfg function of the Web Management Interface of Totolink A8000RU firmware 7.1cu.643_b20200521. The record states that the lang argument can be manipulated remotely to run OS commands and that a public exploit is available. VulDB, as CNA, scores it CVSS 3.1 9.8 (Critical), and no fixed version is listed in the sources consulted.

CVE-2026-9456 is a critical OS command injection flaw (CWE-77) in the Web Management Interface of the Totolink A8000RU, reachable remotely through the setOpenVpnCfg function. The CNA, VulDB, scores it 9.8 under CVSS 3.1 and states that a public exploit exists. CISA KEV does not list it, so no confirmed exploitation in the wild appears in the sources consulted.

DumbAssets through version 1.0.11 has a path traversal flaw in its file deletion endpoint that can let unauthenticated attackers delete arbitrary files on the server. The record assigns a CVSS 3.1 base score of 9.1 (critical), and deleting files such as server.js or package.json could cause complete denial of service. No confirmed exploitation appears in the sources consulted, and the record lists no fixed version.

CVE-2026-9478 is an OS command injection weakness (CWE-77) in the setParentalRules function of the Web Management Interface of the Totolink A8000RU, firmware 7.1cu.643_b20200521. VulDB rates it 9.8 (critical) under CVSS 3.1 and reports that the attack can be carried out remotely. The record states that a public exploit exists, but CISA KEV does not list the CVE and no fixed version is recorded in the sources.

CVE-2026-9102 is a path traversal flaw in the ComparisonService of Altium Enterprise Server, caused by missing filename sanitization in the Gerber file upload APIs. According to the record, an authenticated workspace user can write files outside the intended temporary upload directory, which could lead to code execution or service disruption. The CNA rates it critical with a CVSS 4.0 score of 9.4, and no confirmed exploitation appears in the sources consulted.

CVE-2026-44451 affects Lumiverse versions before 0.9.7, where user-supplied TSX in the component override system can escape its sandbox. The record describes both the identifier shadowing and the static source validator as bypassable, and a malicious theme pack can carry the trigger. The record's description states the issue is fixed in 0.9.7, and no confirmed exploitation appears in the sources consulted.

phpMyFAQ versions before 4.1.2 contain an unauthenticated SQL injection flaw in the BuiltinCaptcha component, where User-Agent header values are placed into database queries without sanitization. The record links the issue to the public GET /api/captcha endpoint and reports a CVSS 3.1 base score of 9.8 from VulnCheck. No confirmed exploitation appears in the sources consulted, and the record lists no fixed version explicitly, so upgrading to 4.1.2 or later is the main defensive step.

CVE-2026-9408 is recorded as an OS command injection flaw in the Web Management Interface of Totolink A8000RU firmware 7.1cu.643_b20200521, reached through the setStaticDhcpRules function. The record states that the attack can be performed remotely and that a public exploit exists. The CNA assigned a CVSS 3.1 score of 9.8 (Critical), and no confirmed active exploitation appears in the sources consulted.

A command injection flaw (CWE-77) has been reported in the Web Management Interface of Totolink A8000RU firmware 7.1cu.643_b20200521. According to the CNA record, manipulating the servername argument of setOpenVpnCertGenerationCfg in /cgi-bin/cstecgi.cgi may allow remote OS command injection, and the record notes that a published exploit may be used. The CNA rates it 9.8 under CVSS 3.1, and the record shows it is not listed in CISA KEV.

CVE-2026-82101 affects IBM DataStage on Cloud Pak for Data 5.4.0.0. According to the record, a remote authenticated attacker could cause a denial of service through a path traversal weakness (CWE-22). The CNA rates it critical with a CVSS 3.1 base score of 9.6, but the record has no affected version range or fix, so the IBM bulletin should be checked.

GitLab has fixed CVE-2026-97229 in CE and EE for versions from 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2. According to the record, under certain conditions an unauthenticated user could execute arbitrary code on the GitLab server through a specially crafted regular expression in a CI/CD configuration. NVD and the CNA assign a CVSS 3.1 base score of 10.0 (critical), and the CVE is not listed in CISA KEV.

A CI workflow for the Saltyorg Docs site can run attacker-authored build code from a fork pull request inside a privileged workflow that has deployment secrets. The record classifies this as CWE-94 with a CVSS 3.1 score of 10 and a fix in commit 649c9aea2daef1168eeb0415b44e65dbbde9f220. The KEV catalog does not list this CVE and no confirmed exploitation appears in the sources consulted.

Form Notify for Any Forms, a WordPress plugin, contains an authentication bypass in versions up to and including 1.1.10. Because the LINE OAuth login relies on a client-supplied cookie to choose the account, unauthenticated attackers may be able to sign in as any site user, including administrators. The record assigns CVSS 3.1 9.8 (Critical), lists no fixed version, and shows no CISA KEV listing.