Analysis

PhpSpreadsheet versions before 1.30.5 contain a bypass of an earlier fix for CVE-2026-34084, where a crafted phar path defeats the wrapper check. According to the GitHub advisory, this can lead to deserialization of attacker-controlled phar metadata, and the CNA assigned a critical CVSS 4.0 score of 9.2. The issue is fixed in 1.30.5, and no confirmed exploitation appears in the sources consulted.

CVE-2026-100730 is a critical deserialization of untrusted data flaw (CWE-502) in a service console interface of Grid Protection Alliance openPDC and openHistorian. The record reports CVSS 3.1 9.8 and CVSS 4.0 9.3, and it describes possible remote code execution under the service account privileges. The sources consulted do not show confirmed exploitation, and the record lists no fixed versions, so operators should check the vendor and CISA guidance.

CVE-2026-7165 is a critical issue (CVSS score 9.4) reported by INCIBE in the /addJugador endpoint of the Assassin game by Gaudire. The record describes weak input validation, missing authorization checks, self-assignable administrative privileges, a denial-of-service condition and server-side request exposure. No fixed versions or affected version ranges appear in the consulted sources, so defenders should rely on the vendor and CERT notice.

CVE-2026-7166 describes an API that exposes email and phone number values, and a local database with the same weakness that contains accessible data on minors and municipal users. The CNA rates it 9.2 under CVSS 4.0 and reports high confidentiality impact for an unauthenticated remote attacker. The record shows no KEV listing, no affected versions and no fixes, so scope and remediation status are unknown.

CVE-2024-58351 affects Flowise before 2.1.4 and allows configuration to be injected into the Chainflow during execution through the overrideConfig option, in both the web integration and the Prediction API. The description reports possible remote code execution, sandbox escape, denial of service, SSRF and data exfiltration, and states that the feature is enabled by default. The record contains no confirmed exploitation and no structured affected or fixed version data, so upgrade planning should rely on the cited advisories.

Autodesk has disclosed a critical code injection flaw in the MCP extension of Autodesk Fusion. According to the record, a maliciously crafted webpage visited by a user with Fusion Desktop running and the extension enabled could lead to arbitrary code execution with that user's privileges. Versions earlier than 2703.1.20 are listed as affected, and a vendor patch is referenced.

SP LMS (com_splms), a JoomShaper component for Joomla, is affected by CWE-502 deserialization of untrusted data in versions below 4.1.4. The record states that an unauthenticated remote attacker could execute arbitrary code on the server. No confirmed exploitation appears in the sources consulted, and the record provides no fixed version or KEV listing.

CVE-2026-45480 is an improper authentication weakness (CWE-287) in Microsoft Azure Active Directory that, according to the CNA description, allows an unauthorized attacker to elevate privileges over a network. The CNA rates it critical with a CVSS 3.1 base score of 10. The sources consulted do not list affected or fixed versions, and the CVE is not in CISA KEV.

CVE-2026-12486 describes multiple OS command injection flaws in the libNetSetObj.so library of GeoVision GV-I/O Box 4E 2.09, which can be reached through network requests. The CVSS 3.1 score of 9.1 comes from the CNA, and the weakness is classified as CWE-78. The record shows no CISA KEV listing, no EPSS data, and no affected or fixed version information.

CVE-2026-51843 is a stack-based buffer overflow (CWE-121) in Tenda AC7 firmware version 15.03.06.44, reachable through the /goform/AdvSetMacMtuWan interface. NVD rates it critical with a CVSS 3.1 base score of 9.8 and a network attack vector requiring no privileges or user interaction. The record shows no KEV listing, no EPSS score and no fixed version.

ProxySQL versions from 2.0.18 up to 3.0.8 contain a pre-authentication out-of-bounds write (CWE-787) in the first-read paths of their MySQL and PostgreSQL protocol handling. The NVD record rates it critical with a CVSS 3.1 base score of 9.8 and a network, no-privilege, no-interaction vector. Version 3.0.9 is stated to patch the issue, and no confirmed exploitation appears in the sources consulted.

Langflow versions before 1.9.2 contain a critical code injection flaw in the Shareable Playground feature, which lets unauthenticated users run public flows through a link. The CNA record assigns a CVSS 3.1 base score of 9.6 and states the issue is fixed in 1.9.2. No confirmed exploitation appears in the sources consulted.

Microsoft has published CVE-2026-48582, a missing authorization flaw (CWE-862) in Microsoft Exchange Online that lets an authorized attacker elevate privileges over the network. The CNA rates it critical with a CVSS 3.1 base score of 9.6. The sources consulted list no confirmed exploitation and no affected or fixed version numbers.

Multiple OS command injection flaws in the libNetSetObj.so library of GeoVision GV-I/O Box 4E 2.09 may allow command execution through crafted network input. The record rates the issue critical with a CVSS 3.1 base score of 9.1, but it lists no affected version range and no fixed version. No confirmed exploitation appears in the sources consulted.

CVE-2026-12851 describes multiple OS command injection flaws in the libNetSetObj.so library of the GeoVision GV-I/O Box 4E 2.09, where configuration values such as DNS addresses reach a shell command without sanitization. The CNA assigns a CVSS 3.1 base score of 9.1 (critical) and maps the issue to CWE-78. The record shows no KEV listing, no confirmed exploitation in the sources consulted, and no fixed version.