Analysis

ArcadeDB versions before 26.8.1 have a missing authentication flaw in the Redis wire-protocol plugin, classified as CWE-306. VulnCheck scores it 9.8 (critical) under CVSS 3.1, and the record shows no KEV listing or confirmed exploitation in the sources consulted. Operators should plan an upgrade to 26.8.1 or later and limit access to the Redis port in the meantime.

CVE-2025-11407 describes an OS command injection weakness (CWE-78) in the /upgrade_filter.asp file of D-Link DI-7001 MINI 24.04.18B1, which the record says can be initiated remotely. NVD assigns a CVSS 3.1 base score of 9.8 (critical), while other providers in the record score it lower. The record states that a public exploit exists, but CISA KEV does not list this CVE and the record contains no fixed version.

CVE-2025-40553 affects SolarWinds Web Help Desk versions before 2026.1 and is classified as deserialization of untrusted data (CWE-502). The CVSS 3.1 score provided by the CNA is 9.8 (critical), and the record states that exploitation could occur without authentication to run commands on the host. CISA KEV does not list this CVE, and no confirmed exploitation appears in the sources consulted.

CVE-2026-24871 is a code injection weakness (CWE-94) in the Minecraft-Rcon-Manage project by pilgrimage233, affecting versions before 3.0. The CNA cve_disclosure@tech.gov.sg scored it 10 under CVSS v4.0 with critical severity. No confirmed exploitation appears in the sources consulted, and the record lists no structured fixed version.

GnuPG from 2.5.13 before 2.5.17 and Gpg4win 5.0.0 before 5.0.1 are affected by a stack-based buffer overflow in gpg-agent. It is triggered by a crafted CMS (S/MIME) EnvelopedData message with an oversized wrapped session key. The record says the flaw can easily cause denial of service and that the memory corruption could lead to remote code execution, while NVD scores it 9.8 (CVSS 3.1) and no confirmed exploitation appears in the sources consulted.

The Community Events plugin for WordPress contains an SQL injection flaw in the event_category parameter in all versions up to and including 1.5.1, according to the record. The record describes access by Subscriber-level users and above, while its title suggests no authentication is needed, so the required privilege level is not clear from the available data. Wordfence records a CVSS 3.1 base score of 9.8, no CISA KEV listing and no confirmed exploitation in the sources consulted.

CVE-2025-21589 is an authentication bypass (CWE-288) in Juniper Session Smart Router, Session Smart Conductor and WAN Assurance Managed Routers that the record says can let a network-based attacker take administrative control of the device. The vendor scores it 9.8 under CVSS 3.1 and 9.3 under CVSS 4.0. The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted.

CVE-2025-14988 affects ibaPDA and, according to the CNA record, could allow unauthorized actions on the file system under certain conditions. The record maps the issue to CWE-732 and includes a CNA-provided CVSS 4.0 base score of 10. No affected versions, fixed versions, or confirmed exploitation appear in the sources consulted.

SandboxJS versions before 0.8.26 contain a sandbox escape in which the host AsyncFunction constructor is reachable from inside the sandbox through the constructor property of an async function. The GitHub advisory describes this as allowing code to run outside the sandbox with potential full host access, and the GitHub CNA rates it critical with a CVSS 3.1 score of 10. Version 0.8.26 contains the fix, and no confirmed exploitation appears in the sources consulted.

Dirsearch 0.4.1 contains a CSV injection weakness in reports generated with the --csv-report flag. Attackers may influence report content through redirected endpoints so that spreadsheet formulas end up in the CSV. The record gives a CVSS 3.1 base score of 9.8 and does not list the CVE in CISA KEV.

Dozzle versions before 9.0.3 contain an incorrect authorization flaw in agent-backed shell endpoints. A user restricted by label filters may reach an interactive root shell in containers outside their scope on the same agent host. Upgrading to version 9.0.3, which contains the patch, is the primary remedy.

CVE-2025-69562 describes an SQL injection flaw in the /insertmessage.php endpoint of code-projects Mobile Shop Management System 1.0, reachable through the userid parameter. The CNA assigned a CVSS 3.1 score of 9.8 (critical) with a network attack vector, low complexity, and no privileges or user interaction required. The record does not list the vulnerability in CISA KEV, and no confirmed exploitation appears in the sources consulted.

CVE-2020-36964 affects the YATinyWinFTP FTP server and allows a remote attacker to crash the FTP service through a malformed command. The record rates it 9.8 under CVSS 3.1 and 8.7 under CVSS 4.0, and classifies it as an out-of-bounds write (CWE-787). No affected or fixed versions are listed, and it is not in the CISA KEV catalog.

SolarWinds Web Help Desk is affected by an authentication bypass vulnerability tracked as CVE-2025-40554, which could allow an attacker to invoke specific actions within the application. The CNA scores it as critical with CVSS 3.1 9.8. The record lists versions below 2026.1 as affected and does not show confirmed exploitation in the sources consulted.

CVE-2026-24832 is an out-of-bounds write vulnerability (CWE-787) in the ixray-team ixray-1.6-stcop project, affecting versions before 1.3 according to the record. The CNA assigned a CVSS 3.1 base score of 9.8 (Critical) with network attack vector and no privileges or user interaction required. The sources consulted do not show confirmed exploitation, and the record lists no fixed version.