Analysis

CVE-2026-85956 affects Progress MarkLogic Server and allows a remote attacker with delegated database-administrator privileges to run backup or restore operations on forests outside their authorized database scope. Progress Software reports a CVSS 3.1 base score of 9.6 (critical) and the affected ranges are 11.0.0 to before 11.3.7 and 12.0.0 to before 12.1.0. No confirmed exploitation appears in the sources consulted, and the record lists no fixed versions, so administrators should consult the vendor advisory directly.

A heap buffer overflow in the Chromecast component of Google Chrome before 150.0.7871.47 could let a remote attacker who already compromised the renderer process attempt a sandbox escape through a crafted HTML page. The CNA scores it 9.6 (CVSS v3.1, critical), but the sources consulted show no confirmed exploitation. Updating Chrome to a fixed build is the main remediation step.

A stored cross-site scripting flaw in SiYuan's Attribute View names can inject HTML into connected clients. The advisory states that, because the Electron main window runs with Node integration enabled and context isolation disabled, this injection can lead to code execution. The record states the issue is fixed in version 3.7.0.

Dragonfly versions before 1.40 contain a double-free (CWE-415) in the RDB stream loading logic, reachable through the RESTORE command. The record reports a GitHub CVSS 3.1 score of 9.6 and says that, with default settings, an unauthenticated client could potentially trigger it. No fixed release is mapped in the record, so operators should restrict access and monitor until a confirmed fix is available.

CVE-2026-13920 is an improper input validation flaw in the Media component of Google Chrome on Windows before 150.0.7871.47. According to the record, a remote attacker who has already compromised the renderer process could potentially escape the sandbox using a crafted HTML page. The record lists a CVSS 3.1 score of 9.6, while Google's own Chromium severity rating is Medium, and no confirmed exploitation appears in the sources consulted.

efw4.X, an Enterprise Framework for Web, does not validate the dst parameter used by elfinder_paste, although target and targets are checked. According to the record, this allows file copy or move to arbitrary destinations and bypasses the protected=true control in versions prior to 4.08.010. The record rates it critical (CVSS 4.0 9.3) and states it is fixed in 4.08.010.

JunoClaw, an agentic AI platform built on Juno Network, had MCP write tools that accepted a raw BIP-39 mnemonic as an explicit tool-call parameter. This placed the wallet seed inside LLM tool-call JSON, where it could reach transport, logging or telemetry surfaces. The record states the issue is fixed in 0.x.y-security-1, and the CVSS 3.1 base score reported by GitHub is 9.8 (critical).

Note Mark, an open-source note-taking application, does not enforce a minimum length or entropy on its JWT_SECRET setting before version 0.19.4. The record reports that a secret as short as 1 byte is accepted, which could allow token forgery and full account takeover. The record fixes the issue in 0.19.4 and does not list it in CISA KEV.

IBM disclosed a privilege escalation flaw in Db2 Mirror for i versions 7.4, 7.5 and 7.6, rated critical with a CVSS 3.1 base score of 9.9. The issue requires an authenticated attacker and could lead to elevated privileges on the affected system. No confirmed exploitation appears in the sources consulted, and the record lists no fixed versions, so administrators should check the vendor advisory.

CVE-2026-41551 is a path traversal vulnerability (CWE-23) in ROS# affecting versions below V2.2.2, caused by insufficient sanitization of user input. The record describes it as allowing a remote attacker to access arbitrary files on the device, and the CNA rates it as critical with CVSS 3.1 score 9.1. The sources consulted show no confirmed exploitation, and the record lists no affected product entries or fixed versions.

A command injection weakness (CWE-77) in the setDMZ function of the Linksys E1700 version 1.0.0.4.003 can be triggered remotely by manipulating the MAC_addr argument. VulDB rates it critical, with a CVSS 3.1 base score of 9.9 published by the CNA. A public exploit is referenced, the vendor did not respond to the disclosure, and the record lists no fixed version.

Google Chrome's Skia graphics library does not sufficiently validate untrusted input (CWE-20). According to the record, a remote attacker who has already compromised the renderer process could potentially escape the sandbox using a crafted HTML page. NVD lists a CVSS 3.1 base score of 9.6, and the CVE is not listed in CISA KEV in the sources consulted, so the main defensive step is updating Chrome to the version named in the description.

CVE-2026-42457 is a stored cross-site scripting flaw (CWE-79) in vCluster Platform, reached through the name field of a templateRef. According to the record, it can run scripts in the platform browser context and, in the worst case, allow creation of a Global-Admin user, and the attacker needs the ability to create namespaces. The record rates it critical with CVSS 3.1 score 9.0 and lists fixed versions 4.4.3, 4.5.5, 4.6.2, 4.7.1 and 4.8.0.

The InfusedWoo Pro plugin for WordPress has a missing authorization flaw that, according to the record, lets unauthenticated users gain elevated privileges, including access to administrator accounts. Wordfence rates it critical with a CVSS 3.1 score of 9.8. The record does not identify a fixed version, so site owners should confirm the vendor status and reduce exposure now.

CVE-2026-44212 is a stored cross-site scripting flaw in the PrestaShop back-office Customer Service view, affecting versions before 8.2.6 and from 9.0.0-alpha.1 before 9.1.1. According to the record, an unauthenticated attacker can submit a payload through the public Contact Us form, which runs when a back-office employee opens the affected thread. The CNA rates it critical with a CVSS v3.1 score of 9.3, and no confirmed exploitation appears in the sources consulted.