Analysis

CVE-2026-49230 affects the jwe-decrypt plugin of Apache APISIX under its default configuration, where improper validation of an integrity check value can allow authentication bypass. The description states that versions from 3.8.0 through 3.16.0 are affected and that upgrading to 3.17.0 fixes the issue. NVD rates it 9.1 (critical) under CVSS 3.1, and no confirmed exploitation appears in the sources consulted.

CVE-2026-96809 is a blind SQL Injection (CWE-89) in the EduAdmin Booking plugin (eduadmin-booking) for WordPress, as reported by Patchstack. The record places affected versions before 6.0.0 and assigns a CVSS 3.1 score of 9.3 (critical). No confirmed exploitation appears in the sources consulted, and the CVE is not listed in CISA KEV.

Poweradmin versions before 4.2.4 and 4.3.3 build OIDC, SAML and logout callback URLs from the HTTP Host request header without validation, and the header is controlled by the requester. The record states that an unauthenticated attacker could redirect authorization codes to a server they control, leading to full account takeover. Versions 4.2.4 and 4.3.3 patch the issue.

A stack-based buffer overflow in the DVRSearch service of the GV-I/O Box 4E, reachable over UDP port 10001, is rated CVSS 3.1 base score 10.0 in the record. The service runs by default and any user on the network can send it messages. The record lists no affected or fixed versions, and no confirmed exploitation appears in the sources consulted.

Mojolicious::Plugin::Web::Auth::OAuth2 for Perl, in versions through 0.17, builds its default OAuth2 state value from low-entropy inputs when no state generator is configured. A predictable state value can enable cross-site request forgery against OAuth2 flows. The CNA reports a CVSS 3.1 base score of 9.1, the record shows no KEV listing, and no confirmed exploitation appears in the sources consulted.

FOSSBilling versions prior to 0.8.0 contain a Server-Side Template Injection flaw in Twig template rendering, reachable by administrators through email templates, mass mail campaigns, custom payment adapters and the string_render API endpoint. The record states that successful exploitation can lead to information disclosure and remote code execution. Upgrading to 0.8.0 is the stated fix, and no confirmed exploitation in the wild appears in the sources consulted.

CVE-2026-54305 affects n8n versions before 1.123.55, 2.25.7 and 2.26.2 (for the 2.x line, from 2.0.0 and from 2.26.0 respectively). Three enterprise edition endpoints used by the Dynamic Credentials feature accepted any authenticated session without per-resource ownership or scope checks, which the record describes as exposing credential metadata and allowing credential token overwrite or revocation. Upgrading to the fixed versions is the documented remediation.

A reflected cross-site scripting flaw in the Immich login page (CWE-79) lets a crafted link run JavaScript in the application origin. The record states this can be used to create an all-permission API key on the victim's account, enabling persistent takeover. The advisory references a fix in commit 4eb1003, and CISA KEV does not list this CVE.

CVE-2026-7664 affects IBM Langflow OSS from 1.0.0 through 1.8.4. According to the record, improper authorization enforcement in the Streamable MCP transport endpoint could let unauthenticated attackers access protected MCP project resources and run MCP operations. NVD assigns a CVSS 3.1 base score of 9.8 (Critical), and the record lists no CISA KEV entry.

The Avada (Fusion) Builder plugin for WordPress contains an arbitrary file deletion flaw caused by insufficient file path validation in all versions up to and including 3.15.3. The record lists a critical severity with a CVSS score of 9.1 from Wordfence and classifies the weakness as path traversal (CWE-22). No confirmed exploitation appears in the sources consulted.

A weakness in the MCP Proxy component of BerriAI LiteLLM, classified as CWE-287 Improper Authentication, is described as affecting versions up to 1.59.8. NVD assigns a CVSS v3.1 base score of 9.8 (critical), and the record notes a publicly available exploit, while CISA KEV does not list this CVE. Defenders should prioritize upgrading to 1.59.9 or later and limiting network exposure of the proxy.

CVE-2026-50242 affects JetBrains Hub and is described as an authentication bypass through direct database access that could lead to administrative access. The CNA rates it critical, and NVD lists a CVSS 3.1 base score of 9.8 with network attack vector and no privileges or user interaction required. No confirmed exploitation appears in the sources consulted, and the vendor advisory is the primary reference for remediation.

NI grpc-device 2.17.0 and prior versions contain an insecure default credentials weakness (CWE-306) when no TLS configuration is present and the server is bound beyond loopback. The record rates it critical, with a CVSS 3.1 base score of 9.1 and a CVSS 4.0 score of 9.3, and states it may allow unauthenticated access on the local network. No confirmed exploitation appears in the sources consulted.

CVE-2026-51846 is a stack-based buffer overflow in the wanSpeed parameter of the Tenda AC7 firmware version 15.03.06.44, according to the CVE record. The record describes the flaw as enabling remote arbitrary code execution and assigns a CVSS 3.1 base score of 9.8 (Critical). The CISA KEV catalog does not list this CVE, and no confirmed exploitation appears in the sources consulted.

CVE-2026-11807 is a missing authorization flaw in the Event-Driven Ansible websocket endpoint, which does not check user permissions when processing Worker messages. According to the record, an authenticated user can obtain plaintext credentials tied to an arbitrary activation, and the CNA scores it 9.6 under CVSS 3.1. No confirmed exploitation appears in the sources consulted.