Analysis

Cap-go versions before 12.128.2 contain an authentication bypass in OTP verification that can let an attacker falsely complete email verification by altering server responses. According to the record, this can enable unauthorized 2FA activation and account takeover, and the CVSS 3.1 base score is 9.4 (critical).

CVE-2026-44789 affects n8n, an open source workflow automation platform, and is classified as prototype pollution (CWE-1321). According to the record, an authenticated user who can create or modify workflows could abuse an unvalidated pagination parameter in the HTTP Request node to pollute global objects, which combined with other techniques could lead to remote code execution. Fixed versions are 1.123.43, 2.20.7 and 2.22.1, and no confirmed exploitation appears in the sources consulted.

CVE-2026-12485 is a stack-based buffer overflow (CWE-121) in the DVRSearch UDP service of the GV-I/O Box 4E embedded device, as described in the record. According to the record, the service runs by default and can be reached by any user on the network. The CNA-provided CVSS vector rates it critical, but the record lists no affected or fixed versions and no confirmed exploitation.

IBM has published CVE-2026-12628, a critical authentication bypass in IBM Storage Protect Client and IBM Storage Protect Snapshot For Windows caused by a hard-coded credential in the FlashCopy Manager authentication mechanism. The record assigns CVSS 3.1 base score 9.1 with CWE-798 and lists an IBM patch reference. No confirmed exploitation appears in the sources consulted.

CVE-2026-42716 is an unauthenticated PHP Object Injection flaw (CWE-502) in the Payever - WooCommerce Gateway WordPress plugin, versions up to and including 4.8.2. Patchstack reports a CVSS 3.1 base score of 9.8 (critical). The sources consulted show no confirmed exploitation, and the record does not identify a fixed version.

picklescan versions before 1.0.4 fail to block at least seven Python standard library modules that expose eight functions capable of direct command execution. According to the record, a crafted pickle file importing these modules could lead to remote code execution while bypassing the scanner's safety validation. The CNA VulnCheck reports a CVSS 3.1 base score of 9.8 (critical); no confirmed exploitation appears in the sources consulted.

The Invoice Generator plugin for WordPress has a password reset flaw that lets unauthenticated attackers set the password of arbitrary accounts, including administrators. The record states that all versions up to and including 1.0.0 are affected and rates the issue critical with CVSS 3.1 base score 9.8. The record lists no fixed version and no confirmed exploitation.

Electron, a framework for cross-platform desktop applications, has a critical flaw in its Buffer component where byte lengths are calculated incorrectly, causing heap buffer underflows or overflows. The record states the issue affects versions from 42.3.1 until 42.3.3 and is fixed in 42.3.3. The sources consulted show no confirmed active exploitation.

CVE-2026-56274 affects Flowise versions before 3.1.2 and is classified as OS command injection (CWE-78) in the Custom MCP Server feature. According to the record, a user with a Flowise account of any role, or API access with chatflow view/update permissions, can configure a malicious MCP server that bypasses the command-flag and local file access checks to run arbitrary commands on the host. The record reports a CVSS 3.1 base score of 9.9 and a CVSS 4.0 score of 8.7 from VulnCheck, and does not list CISA KEV status.

CVE-2026-11374 affects four ManageEngine products and concerns SSO tickets that are generated to authenticate a session and could be predicted by an unauthenticated user. The CNA classifies the issue as critical with a CVSS 3.1 base score of 9.0 and maps it to CWE-287 (Improper Authentication), with account takeover named as the consequence. At the time of analysis the record lists no affected versions, no fixed versions and no KEV listing.

CVE-2026-53753 affects Crawl4AI versions before 0.8.7, where the computed fields expression evaluator can be bypassed because its AST validator only blocks attributes starting with an underscore. According to the record, this allows a sandbox escape leading to arbitrary code execution, reachable without authentication via POST /crawl when JWT is disabled, which is the default. The record states the issue is fixed in 0.8.7, and CVSS 3.1 scores of 10 (NVD) and 9.8 (GitHub) are listed.

CVE-2026-6653 is a use-after-free flaw (CWE-416) in the xmlParseInternalSubset routine of GNOME libxml2 versions 2.9.11 through 2.11.0, which can lead to denial of service when crafted XML input is processed. The NVD assigns a CVSS 3.1 score of 9.8 (critical), while the Ubuntu CNA lists a CVSS 4.0 score of 7. A patch reference is listed, no fixed version is stated in the record, and no confirmed exploitation appears in the sources consulted.

CVE-2026-56422 affects several MISP core controllers and model capture paths, where client-supplied primary keys and ownership or scope foreign keys were not consistently pinned to the authorized object. An authenticated user with access to one object could, in affected paths, cause MISP to save data against a different object. The record reports a CNA CVSS 4.0 score of 9.4, no KEV listing, and no affected or fixed version ranges.

CVE-2026-48020 is a path-handling flaw in the StripPrefix middleware of Traefik, an HTTP reverse proxy and load balancer, affecting releases before 2.11.48, 3.6.19 and 3.7.3. According to the record, an unauthenticated attacker may reach routes protected by authentication middleware when a public PathPrefix router uses StripPrefix. The issue is fixed in 2.11.48, 3.6.19 and 3.7.3, and the record does not show confirmed exploitation in the sources consulted.

MessagePack for C# versions before 2.5.301, and the range from 3.0.3 up to but not including 3.1.7, use a parameterless input formatter constructor whose default options select the trusted-data security profile. This can expose ASP.NET Core MVC applications to denial-of-service attacks, such as hash-collision attacks against dictionary-like model properties. The fix is available in 2.5.301 and 3.1.7; the NVD assigns a CVSS 3.1 score of 9.1, and no confirmed exploitation appears in the sources consulted.