Analysis

CVE-2026-51845 describes a stack-based buffer overflow (CWE-121) in the /goform/AdvSetMacMtuWan interface of Tenda AC7 firmware version 15.03.06.44, triggered through the mac parameter. NVD scores it 9.8 (Critical) under CVSS 3.1 with network attack vector and no privileges or user interaction required. The record shows no KEV listing, no EPSS data and no fixed version.

CVE-2026-105889 is an SQL injection flaw (CWE-89) in the Tickera event ticketing plugin for WordPress, affecting versions up to and including 3.6.0.6, which allows blind SQL injection. Patchstack scored it 9.3 (critical) under CVSS 3.1 with a network attack vector and no privileges required. The record lists no fixed version and no confirmed exploitation in the CISA KEV catalogue.

CVE-2026-51844 is a stack-based buffer overflow (CWE-121) reported in Tenda AC7 firmware v15.03.06.44, triggered through the cloneType parameter of the /goform/AdvSetMacMtuWan interface. NVD and a second scoring provider both rate it CVSS 3.1 9.8 (Critical), and no fixed version is listed in the record. CISA KEV does not list it and no confirmed exploitation appears in the sources consulted.

CVE-2026-44792 is a critical SQL injection flaw (CWE-89) in n8n, an open source workflow automation platform. An attacker with write access to a connected Source Control git repository could plant a crafted Data Table JSON file that is processed when an administrator runs a Source Control Pull, affecting instances that use PostgreSQL. Fixed versions are 1.123.43, 2.20.7 and 2.22.1, and the record shows no confirmed exploitation.

IBM has published CVE-2026-9072 affecting WebSphere Application Server and WebSphere Application Server Liberty when used with Intelligent Management and the WebSphere WebServer Plug-in. The record describes remote code execution and denial of service that can be triggered when an attacker impersonates backend servers and sends crafted responses to the plug-in. NVD scores it 9.8 (critical) under CVSS 3.1, but the record's affected-product field does not match the WebSphere description, so scope should be confirmed with the IBM bulletin.

IBM disclosed an HTTP request smuggling weakness (CWE-444) in WebSphere Application Server 8.5 and 9.0 and in WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.6. The record describes a remote attacker who can smuggle a crafted request to bypass security controls, spoof identity, escalate privilege and expose sensitive information. No confirmed exploitation appears in the sources consulted, and the record lists no KEV entry.

CVE-2026-11551 affects the Branda WordPress plugin in all versions up to and including 3.4.29. The plugin does not properly verify a user's identity before updating a password, allowing unauthenticated attackers to change passwords of other users, including administrators. The record reports a CVSS 3.1 score of 9.8 (Critical), and no confirmed exploitation appears in the sources consulted.

CVE-2026-96330 is a blind SQL Injection (CWE-89) in the tagDiv Opt-In Builder WordPress plugin, affecting versions through 1.7.6 according to the record. Patchstack reports a CVSS 3.1 base score of 9.3, rated critical. The record lists no fixed version and no confirmed exploitation in the sources consulted.

CVE-2026-42723 is a critical PHP Object Injection flaw (CWE-502) in the CleanSkin WordPress theme by AncoraThemes, affecting versions up to and including 1.5.0. The record describes it as unauthenticated and lists a CVSS 3.1 base score of 9.8 from Patchstack. The sources consulted show no fixed version and no confirmed exploitation.

Langflow versions before 1.9.2 contain a flaw that lets an attacker who controls files ingested into a RAG workflow make a component read any file on the host by absolute path. The GitHub CNA assigns a CVSS 3.1 base score of 9.6, and the record states the issue is fixed in 1.9.2. The CISA KEV catalog does not list this CVE, and no confirmed exploitation appears in the sources consulted.

CVE-2026-42718 is an unauthenticated PHP Object Injection flaw (CWE-502) in the Booster for WooCommerce WordPress plugin, versions up to and including 8.4.0. Patchstack, the CNA, rates it 9.8 critical under CVSS 3.1. The record lists no fixed version and no confirmed exploitation.

Deno versions from 2.0.0 before 2.7.8 can send application data without encryption when a TLS client falls back to another address family after a failed first attempt. The flaw is tied to the autoSelectFamily behavior in Deno's Node.js tls compatibility layer and is stated to be fixed in 2.7.8. NVD scores it 9.1 under CVSS 3.1, and no confirmed exploitation appears in the sources consulted.

CVE-2019-25763 is an authentication bypass in the social media login form of WordPress Ultimate Addons for Beaver Builder 1.2.4.1, as described in the record. The CNA VulnCheck rates it critical with CVSS 3.1 score 9.8 and 4.0 score 9.3. The record shows no KEV listing, no confirmed exploitation in the sources consulted, and no affected or fixed version list.

CVE-2026-49468 is a critical authentication bypass (CWE-290) in the LiteLLM proxy before 1.84.0. A crafted Host header can make the authentication layer evaluate a different route from the one actually dispatched, which may expose protected management routes without authentication under specific conditions. The record indicates a fix in 1.84.0, and the vulnerability is not listed in CISA KEV.

A stack-based buffer overflow in the login functionality of the cgi-bin/cstecgi.cgi endpoint of the Totolink EX1200L router is rated critical, with CVSS v4.0 score 9.4, by the CNA CERT Polska. The description states that exploitation could crash the program and allow remote code execution with root-level impact. The vulnerability was confirmed only in version 9.3.5u.6146_B20201023, and the vendor did not respond to contact attempts.