Analysis

deepstream server versions prior to 10.0.5 contain a prototype pollution flaw (CWE-1321) that an authenticated user with write permission to any record could abuse for potential privilege escalation. The GitHub CNA rates it 9.9 (critical) under CVSS 3.1, and the issue is fixed in version 10.0.5.

CVE-2025-62493 is a heap out-of-bounds read in the js_bigint_to_string1 function of the QuickJS engine, caused by an off-by-one error when calculating the number of digits needed for a BigInt string conversion. The record classifies it as CWE-125 with a NVD CVSS 3.1 base score of 6.5 and a Google CVSS 4.0 score of 5.9. The sources consulted show no confirmed active exploitation and no listing in CISA KEV.

CVE-2026-40624 is an improper input validation flaw in AVer PTC500S, PTC115, PTC500+ and PTC115+ cameras. It may let a remote, unauthenticated attacker run arbitrary code through a specially crafted web request, and it carries a critical CVSS 3.1 score of 9.8. No confirmed exploitation appears in the sources consulted.

Two SQL Editor endpoints in pgAdmin 4 server mode lacked the login-required check and reach a pickle deserialization sink, affecting versions from 6.9 before 9.16. Remote code execution additionally requires knowledge of the Flask SECRET_KEY and write access to pgAdmin's sessions directory, so the flaw mainly amplifies an existing partial compromise. No confirmed exploitation appears in the sources consulted.

CVE-2026-47647 is an improper access control flaw (CWE-284) in Microsoft Dynamics 365 that lets an authorized attacker elevate privileges over a network. Microsoft rates it CVSS 3.1 9.9 (critical), with a changed scope and high impact on confidentiality, integrity and availability. No confirmed exploitation appears in the sources consulted.

Relyra, a SAML Service Provider library for Elixir and Phoenix, did not cryptographically verify SAML signatures in versions 1.0.0 and 1.1.0, allowing forged assertions with an attacker-chosen NameID to be accepted. The flaw is rated critical (CVSS 9.1) and is fixed in version 1.2.0.

mcp-pinot, a Python MCP server for Apache Pinot, defaults in versions 3.0.1 and below to an HTTP server bound to 0.0.0.0:8080 with no authentication. Any reachable caller can invoke tools for SQL queries, schema creation and table-config changes using the server's own Pinot credentials. The issue is rated CVSS 3.1 10.0 and is fixed in version 3.1.0.

Coturn TURN/STUN server versions prior to 4.10.0 contain a stack buffer overflow in decode_oauth_token_gcm() that can be triggered by an unauthenticated attacker when the non-default --oauth mode is enabled. The overflow happens before AES-GCM authentication, so no knowledge of the OAuth key is required, and it may provide a plausible remote code execution primitive. The issue is fixed in Coturn 4.10.0.

Bitnami Cassandra container images may leave the built-in cassandra superuser active after a custom administrator is configured via CASSANDRA_USER, creating an unintended access path with well-known default credentials. The CNA rates the issue critical (CVSS 3.1 score 9.8), and fixed image builds are listed for the 4.0, 4.1 and 5.0 branches.

CVE-2026-38717 is a command injection flaw (CWE-77) in the file upload function of InHand Networks IR912 and IR915 industrial routers that lets remote attackers run arbitrary commands as root. It is rated critical with a CVSS base score of 9.8. No confirmed exploitation appears in the sources consulted, but exposed devices should be updated and isolated quickly.

CVE-2026-38716 is a critical command injection flaw (CWE-77) in the Python application export function of InHand Networks IR912 and IR915 industrial routers. A remote attacker can execute arbitrary commands as root using crafted input. The vulnerability carries a CVSS 3.1 score of 9.8, and no confirmed exploitation appears in the sources consulted.

CVE-2026-38715 is a command injection flaw (CWE-77) in the log viewing function of InHand Networks IR912 and IR915 industrial routers that lets remote attackers run arbitrary commands as root. It carries a CVSS 3.1 score of 9.8 (critical), and the vendor has published a security advisory.

CVE-2026-38714 is a command injection flaw (CWE-77) in the Python configuration function of InHand Networks IR912 and IR915 industrial routers. A remote attacker can run arbitrary commands as root using crafted input, and NVD rates it 9.8 (critical). No confirmed exploitation appears in the sources consulted.

CVE-2026-54103 describes a missing authentication flaw (CWE-306) in the GAO Electronic Protest Docketing System (EPDS) and the CBCA Electronic Docketing System (EDS), where password change requests to the '/update-profile/N' API endpoint are not authenticated. A remote, unauthenticated attacker could change an arbitrary user's password, and the CNA rates the issue critical (CVSS v3.1 9.8). No confirmed exploitation appears in the sources consulted.

Eclipse 4diac FORTE versions 3.0.0 through 3.1.0 contain a use-after-free flaw (CWE-416) in the handling of DELETE connection commands sent to the management interface. NVD rates it 9.8 (CVSS v3.1), while the Eclipse CNA scores it 5.2 under CVSS v4.0. No confirmed exploitation appears in the sources consulted.