Analysis

CVE-2026-8024 is a deserialization of untrusted data vulnerability (CWE-502) in ibaPDA and ibaDatCoordinator that may let a remote, unauthenticated attacker gain full access to affected systems. The CNA rates it critical with a CVSS 3.1 score of 9.8 and a CVSS 4.0 score of 9.3. Affected versions are not listed in the record, so operators should consult CERT@VDE advisory VDE-2026-051.

CVE-2026-54419 describes multiple unauthenticated SQL injection flaws in claudiopizzillo PIAF-HMS, a hotel management add-on for PBX-In-A-Flash. The application has no authentication and concatenates HTTP parameters directly into deprecated mysql_query calls. The CNA rates it critical (CVSS 3.1 score 9.8), and no fixed release is identified in the sources.

CVE-2026-11718 is a critical authentication bypass (CWE-287) in Google MCP Toolbox for Databases (googleapis/mcp-toolbox), affecting versions 1.0.0 through 1.3.0. When an OAuth 2.0 introspection response omits the optional iss field, the issuer check is silently skipped, so tokens from unintended identity providers can be accepted. A patch is available via GitHub pull request 3360, and no confirmed exploitation appears in the sources consulted.

CVE-2026-11717 is a critical authentication bypass in the opaque token validation path of googleapis/mcp-toolbox, where introspection responses missing the mandatory "active" field are treated as valid. Versions 1.0.0 through 1.3.0 are listed as affected, and a patch is referenced in pull request 3341. No confirmed exploitation appears in the sources consulted.

The Nur-Alam39 bus-ticket PHP project contains an unauthenticated SQL injection flaw in bus_info.php, where the busid POST parameter is concatenated into a MySQL query without sanitization or parameterization. The CNA rates it critical with a CVSS 3.1 score of 9.8. The project has no released versions and no fix is listed in the sources consulted.

A critical OS command injection flaw affects the fwrite function in pigwidgeon.cgi of the Web Management Backend on TRENDnet TEW-751DR, TEW-752DRU and TEW733GR devices (firmware 1.03B01/1.03B03). The issue is reachable remotely via the service argument and a public exploit exists. These are end-of-life products no longer supported by the vendor.

CVE-2026-25371 is a blind SQL injection flaw (CWE-89) in the King-Theme Lumise Product Designer WordPress plugin, rated 9.3 (critical) by Patchstack. The CVSS vector indicates network exploitation without authentication or user interaction, with high confidentiality impact. No confirmed exploitation appears in the sources consulted.

CVE-2026-25366 is a code injection flaw (CWE-94) in the Themeisle Woody ad snippets WordPress plugin (slug insert-php) affecting versions up to and including 2.7.1. Patchstack rates it CVSS 3.1 9.9 (critical), requiring only low privileges over the network. No confirmed exploitation appears in the sources consulted.

CVE-2026-55742 is a Cross-Site Request Forgery flaw in the Cotonti CMS administration rights handler. The rights update action changes group access rights without validating the anti-CSRF token, so a logged-in administrator could be tricked into altering permissions. The CNA rates it critical, with a CVSS 3.1 score of 9.6.

OTRS does not immediately revoke previously issued JWT authentication tokens when an agent or customer user account is deactivated or its password is changed. A token may stay valid until normal expiry, roughly 16 hours, so anyone already holding it keeps that user's access. The CNA rates the issue 9.1 (critical) under CVSS 3.1, and it affects OTRS 7.0.x through 2026.x releases before 2026.7.x.

Ghost, the Node.js content management system, before 6.37.0 let unauthenticated users alter rendered frontend responses with an x-ghost-preview header, which a shared cache could then serve to other visitors. When the frontend and admin panel share a domain, this could lead to staff account takeover. The issue is fixed in 6.37.0 and is rated CVSS 3.1 9.6 (critical).