Analysis

CVE-2026-103928 affects Metabase native queries and actions run against H2 data sources, which pass host-facing built-in functions through without restriction. According to the record, a user authorized to run native queries or actions can read or write arbitrary files on the server or link other databases, and the default sample database makes the surface exposed by default. The record lists fixed versions 1.58.16, 1.59.13, 1.60.9 and 1.61.4, and CVSS 4.0 base score 9.3 (critical).

CVE-2026-13909 affects Google Chrome versions prior to 150.0.7871.47 and involves insufficient policy enforcement in DevTools. According to the record, a remote attacker who had already compromised the renderer process could potentially escape the sandbox through a crafted HTML page. No confirmed exploitation appears in the sources consulted.

WebPros WHMCS does not verify ownership of the addonId value submitted to clientarea.php, so an authenticated client area user can reference another user's add-on. The record describes this as leading to unauthorized access to the victim's account and rates it critical (CVSS 3.1 score 9.1 from the CNA). No confirmed exploitation appears in the sources consulted, and the referenced WHMCS help page is the main source for remediation details.

CVE-2026-44225 affects Pulpy, a cross-platform desktop packager for web apps, in versions prior to 0.1.1. According to the advisory, an incomplete blocklist in validateFsPath() lets any packaged web app read and write arbitrary files in the user's home directory. The record reports a CVSS 3.1 score of 9.3 and no confirmed exploitation in the sources consulted.

IBM i versions 7.3 through 7.6 are affected by a code injection flaw (CWE-94) in the HTTP Server Administration web application, caused by improper data sanitization. The record describes a remote authenticated attacker who could obtain sensitive information or execute arbitrary code, with a CVSS 3.1 base score of 9.9 reported by IBM. The record lists no fixed versions, so the IBM advisory should be reviewed for remediation.

CVE-2026-2347 is an authorization bypass through a user-controlled key (IDOR) in the E-Commerce Website of Akilli Commerce Software Technologies Ltd. Co., affecting versions before 4.5.001. According to the record, the flaw allows session hijacking and has a CVSS 3.1 score of 9.8 (critical), but no confirmed exploitation appears in the sources consulted.

Valtimo versions in the document, case and contract modules evaluate user-supplied Spring Expression Language expressions with an unrestricted evaluation context, classified as CWE-94 code injection. The record states that an authenticated user with the ADMIN role can achieve remote code execution and credential exfiltration, and the NVD and CVE Program pages carry a CVSS 3.1 score of 9.1. No confirmed exploitation appears in the sources consulted, and the record lists a fixed version for document that conflicts with its affected range.

CubeCart versions prior to 6.7.0 contain an authenticated arbitrary file upload flaw in the REST API File Manager endpoint, which can place PHP files in a web-accessible directory. The record links this to a path-traversal weakness and describes the outcome as full remote code execution, with a CVSS 3.1 base score of 9.1. The issue is stated to be fixed in 6.7.0, and no confirmed exploitation appears in the sources consulted.

SAP Commerce Cloud is affected by CVE-2026-34263, caused by improper Spring Security configuration. According to the CNA record, an unauthenticated user may inject malicious input that results in arbitrary server-side code execution. The CNA scores it 9.6 (critical) under CVSS 3.1, and the record does not yet list affected versions or fixes.

CVE-2026-108362 affects Privasys Ra-tls-clients before version 0.11.0. According to the record, the verifier does not require an explicitly authorized platform identity for TEE attestation evidence, so measurements from a different unrevoked TEE platform may be accepted as coming from the intended Attester. The vendor advisory states the issue is fixed in version 0.11.0.

IBM has disclosed a code injection weakness (CWE-94) in IBM Maximo AI Service versions 9.1.0 and 9.2.0 that could allow a remote attacker to execute arbitrary code. The NVD and CVE records list a CVSS v3.1 base score of 9.8 (Critical), but the sources consulted show no confirmed exploitation. Organizations running the affected versions should review the IBM support advisory and confirm the applicable fix before relying on any remediation step.

Progress reported that MarkLogic Server releases in the 11.x line before 11.3.7 and the 12.x line before 12.1.0 can let a remote attacker with query-execution access invoke an XQuery evaluation function without the additional evaluation privilege. The record rates the issue critical with a CVSS 3.1 base score of 9.9 and describes possible server-side code execution with elevated permissions. No confirmed exploitation appears in the sources consulted, and the CVE is not listed in CISA KEV.

CVE-2026-85948 affects Progress MarkLogic Server releases from 11.0.0 before 11.3.7 and from 12.0.0 before 12.1.0. According to the record, an XQuery injection flaw in a deprecated Management API package path could let a remote attacker with manage-user privileges gain persistent unauthorized administrative control. The record carries a CVSS 3.1 base score of 9.9 (critical), and no confirmed exploitation appears in the sources consulted.

ArcadeDB versions from 21.10.1 before 26.4.2 contain two authorization defects that let an authenticated principal, including a token scoped to one database, access other databases on the same server. The record rates the issue critical with a CVSS 3.1 base score of 9.0 and states that it is fixed in 26.4.2. No confirmed exploitation appears in the sources consulted, and the CVE is not listed in CISA KEV.

CVE-2026-13796 is an integer overflow in the Chromecast component of Google Chrome before 150.0.7871.47, as described in the record. A remote attacker who has already compromised the renderer process could potentially escape the sandbox through a crafted HTML page. The record gives a CVSS 3.1 base score of 9.6, and the vendor update is the primary remediation.