54 CVEs tracked today. 10 Critical, 24 High, 18 Medium, 1 Low.
-
CVE-2026-34243
CRITICAL
CVSS 9.8
Command injection in njzjz/wenxian GitHub Actions workflow allows unauthenticated remote attackers to execute arbitrary code on CI/CD runners via malicious issue comments. The workflow directly interpolates untrusted user input from issue_comment.body into shell commands without sanitization, enabling attackers to break out of command context and run arbitrary commands. Publicly available exploit code exists with working proof-of-concept demonstrating execution of injected commands. EPSS data not available, but the low attack complexity (AC:L) and unauthenticated access (PR:N) combined with confirmed POC make this a critical risk for any deployment using the vulnerable workflow.
Command Injection
RCE
-
CVE-2026-34220
CRITICAL
CVSS 9.3
SQL injection in MikroORM JavaScript ORM (versions ≤6.6.9 and ≤7.0.5) allows attackers to execute arbitrary SQL commands when specially crafted user-controlled objects are passed to query construction APIs. The vulnerability stems from duck-typed detection of internal ORM markers that attackers can replicate in malicious input objects. Applications passing unsanitized user input directly to write APIs like wrap().assign(), em.nativeUpdate(), em.nativeInsert(), or em.create() are exploitable. No public exploit identified at time of analysis, though the attack technique is straightforward for environments accepting untrusted JSON/object input.
SQLi
-
CVE-2026-32987
CRITICAL
CVSS 9.3
Bootstrap setup code replay in OpenClaw before 2026.3.13 enables unauthenticated remote attackers to escalate privileges to operator.admin during device pairing. The vulnerability (CWE-294: Capture-replay) in src/infra/device-bootstrap.ts permits multiple verification attempts of valid bootstrap codes before approval, allowing escalation of pending pairing scopes. CVSS 9.3 (Critical) reflects network-accessible attack with low complexity and no user interaction required. EPSS data unavailable; no public exploit identified at time of analysis. Vendor-released patch available via GitHub commit 1803d16d.
Privilege Escalation
-
CVE-2026-32978
CRITICAL
CVSS 9.4
Approval bypass in OpenClaw before 2026.3.11 allows low-privileged remote attackers to execute arbitrary code by exploiting race conditions in system.run approvals. Attackers obtain legitimate approval for benign scripts, then overwrite referenced files before execution via vulnerable tsx/jiti runners. With CVSS 9.4 (critical severity, network-accessible, low complexity) and EPSS data not yet available for this 2026 CVE, organizations using OpenClaw's script execution features face immediate risk despite requiring user interaction and low-level authentication. No public exploit identified at time of analysis, though the approval bypass mechanism is documented in vendor advisory GHSA-qc36-x95h-7j53.
Authentication Bypass
-
CVE-2026-32922
CRITICAL
CVSS 9.4
Privilege escalation in OpenClaw device token rotation (versions before 2026.3.11) enables authenticated attackers with operator.pairing scope to mint tokens with arbitrary elevated scopes, including operator.admin privileges. This scope validation bypass permits remote code execution on connected nodes via system.run API and unauthorized gateway-admin access. CVSS 9.4 (Critical) with network attack vector and low complexity. EPSS and KEV data not provided; no public exploit identified at time of analysis, though technical details disclosed via GitHub security advisory increase exploitation risk.
Privilege Escalation
RCE
-
CVE-2026-32918
CRITICAL
CVSS 9.2
Session sandbox escape in OpenClaw versions prior to 2026.3.11 allows local authenticated attackers with low-privilege sandboxed subagent access to read and modify session data across isolation boundaries by manipulating sessionKey parameters in the session_status tool. Exploitation enables unauthorized access to parent or sibling session state including persisted model overrides, bypassing critical security isolation controls. No public exploit identified at time of analysis, though the authentication bypass mechanism is clearly documented in vendor security advisory.
Authentication Bypass
-
CVE-2026-32915
CRITICAL
CVSS 9.3
Sandbox escape in OpenClaw versions before 2026.3.11 enables low-privilege leaf subagents to bypass isolation boundaries and manipulate sibling processes with elevated tool policies. Local authenticated attackers can terminate competing worker threads, redirect execution flows, and execute operations outside their intended security context by exploiting insufficient authorization on subagent control APIs. EPSS data not available for this recent CVE; no public exploit identified at time of analysis, though the technical advisory provides detailed vulnerability mechanics.
Authentication Bypass
-
CVE-2026-4851
CRITICAL
CVSS 9.8
Arbitrary Perl code execution in GRID::Machine through version 0.127 occurs when clients connect to remote hosts via RPC over SSH, as the client-side deserializer uses eval() on untrusted data from the remote peer without validation. A compromised or malicious remote host can inject arbitrary Perl code into Dumper-formatted responses that executes silently on the client during RPC calls, while maintaining correct return values to avoid detection. The vulnerability is design-inherent but the trust requirement for remote hosts is not documented, creating a security expectation mismatch for users.
Deserialization
RCE
-
CVE-2026-4176
CRITICAL
CVSS 9.8
Perl versions 5.9.4-5.40.3, 5.41.0-5.42.1, and 5.43.0-5.43.8 bundle a vulnerable version of Compress::Raw::Zlib that inherits multiple information-disclosure vulnerabilities from a vendored zlib library, including CVE-2026-27171. Affected users running these Perl versions can experience data exposure through the bundled compression module. Vendor patches are available in Perl 5.40.4, 5.42.2, and 5.43.9 via Compress::Raw::Zlib 2.221.
Information Disclosure
-
CVE-2026-0558
CRITICAL
CVSS 9.8
Unauthenticated file upload in parisneo/lollms versions ≤2.2.0 enables remote attackers to submit arbitrary files for text extraction without authentication via the `/api/files/extract-text` endpoint. The vulnerability (CWE-287: Improper Authentication) allows resource exhaustion DoS attacks and potential information disclosure, with CVSS 7.5 (High) reflecting network-accessible attack surface requiring no privileges. EPSS data not available; no public exploit identified at time of analysis, though the simplicity (AC:L, PR:N) suggests trivial exploitation once endpoint details are known.
Authentication Bypass
Denial Of Service
Information Disclosure
-
CVE-2026-34221
HIGH
CVSS 8.3
Prototype pollution in MikroORM's Utils.merge function allows attackers to modify JavaScript object prototypes when applications pass untrusted user input into ORM operations. Affects @mikro-orm/core npm package, enabling denial of service and potentially SQL injection when polluted properties influence query construction. No public exploit identified at time of analysis, though GitHub security advisory published by the project maintainers confirms the vulnerability class (CWE-1321).
Prototype Pollution
Denial Of Service
SQLi
-
CVE-2026-34215
HIGH
CVSS 8.2
Parse Server's verify password endpoint leaks MFA secrets and OAuth tokens to authenticated users, enabling multi-factor authentication bypass. Attackers who possess a valid user password can extract TOTP secrets and recovery codes from the unsanitized response, then generate valid MFA codes to defeat the second authentication factor. The vulnerability affects the npm package parse-server. No public exploit identified at time of analysis, though exploitation requires only password knowledge and standard API access.
Information Disclosure
-
CVE-2026-34214
HIGH
CVSS 7.7
Trino's Iceberg connector leaks AWS S3 access credentials through query JSON endpoints, allowing authenticated users with write privileges to extract static or temporary credentials used for object storage access. The vulnerability exposes credentials via the query visualization API (/ui/api/query/ and /v1/query/ endpoints) when users perform write or table maintenance operations. With a CVSS of 7.7 and EPSS data not provided, this represents a confirmed credential exposure issue requiring immediate attention for organizations using Iceberg REST catalog configurations with storage credentials. No public exploit identified at time of analysis, though exploitation requires only low-privilege authenticated access.
Information Disclosure
-
CVE-2026-34209
HIGH
CVSS 7.5
A logic error in the mppx npm package (versions <0.4.11) allows remote attackers to close payment channels without committing funds by exploiting an off-by-one validation flaw in the tempo/session cooperative close handler. The handler incorrectly used '<' instead of '<=' when validating close voucher amounts against settled on-chain amounts, enabling attackers to submit vouchers exactly equal to settled amounts for free channel closure or griefing attacks. No active exploitation confirmed (CISA KEV), but publicly available patch and detailed advisory increase exploitation risk. CVSS 7.5 (High) reflects network-accessible, low-complexity attack requiring no authentication.
Information Disclosure
-
CVE-2026-34005
HIGH
CVSS 8.8
Remote code execution with root privileges affects Xiongmai DVR/NVR devices (models AHB7008T-MH-V2 and NBD7024H-P running firmware 4.03.R11) via authenticated OS command injection through the proprietary DVRIP protocol on TCP port 34567. Low-privileged authenticated attackers can inject shell metacharacters into the HostName parameter of NetWork.NetCommon configuration requests, achieving full system compromise due to unsafe system() function usage. CVSS 8.8 (High) with network attack vector and low complexity; no public exploit identified at time of analysis.
Command Injection
-
CVE-2026-33575
HIGH
CVSS 8.6
Credential exposure in OpenClaw gateway pairing mechanism allows remote attackers to extract and reuse long-lived shared gateway credentials embedded in pairing setup codes. Attackers who obtain QR codes or pairing tokens from chat logs, screenshots, or system logs can recover persistent gateway credentials intended for one-time use, enabling unauthorized gateway access without authentication. EPSS data not available; no public exploit identified at time of analysis. Affects OpenClaw versions prior to 2026.3.12.
Information Disclosure
-
CVE-2026-33573
HIGH
CVSS 8.7
Authorization bypass in OpenClaw gateway agent RPC enables authenticated operators with operator.write permission to escape workspace boundaries and execute arbitrary operations outside designated directories. Attackers supply malicious spawnedBy and workspaceDir parameters to perform file and exec operations from any process-accessible location. CVSS 8.7 reflects high confidentiality, integrity, and availability impact with network attack vector and low complexity. No public exploit identified at time of analysis, though EPSS data unavailable. VulnCheck identified this as an information disclosure vector affecting OpenClaw versions prior to 2026.3.11.
Information Disclosure
-
CVE-2026-32980
HIGH
CVSS 8.7
Resource exhaustion in OpenClaw webhook endpoint allows remote attackers to consume server memory and processing resources via unauthenticated Telegram webhook POST requests. OpenClaw versions prior to 2026.3.13 process and buffer entire request bodies before validating authentication tokens, enabling denial-of-service attacks with no authentication required. CVSS 8.7 (High) reflects network-accessible, low-complexity attack with high availability impact. No public exploit identified at time of analysis, though the attack technique is straightforward given the architectural flaw.
Denial Of Service
-
CVE-2026-32979
HIGH
CVSS 7.0
Time-of-check-time-of-use (TOCTOU) race condition in OpenClaw runtime (<2026.3.11) allows local authenticated attackers with low privileges to execute arbitrary code by modifying approved scripts between authorization and execution phases. The vulnerability (CWE-367) enables privilege escalation to the OpenClaw runtime user context, requiring user interaction but trivial attack complexity. No public exploit identified at time of analysis, though EPSS data unavailable and CVE not present in CISA KEV catalog.
RCE
-
CVE-2026-32974
HIGH
CVSS 8.8
Authentication bypass in OpenClaw's Feishu webhook integration (pre-2026.3.12) allows unauthenticated remote attackers to inject forged events and trigger arbitrary downstream tool execution. The vulnerability occurs when administrators configure only verificationToken without encryptKey, enabling attackers to craft malicious webhook payloads that bypass validation. No public exploit identified at time of analysis, though CVSS 8.8 reflects network accessibility (AV:N), zero complexity (AC:L), and no privileges required (PR:N).
Authentication Bypass
Jwt Attack
-
CVE-2026-32973
HIGH
CVSS 8.8
Execution allowlist bypass in OpenClaw (versions prior to 2026.3.11) enables unauthenticated remote attackers to execute arbitrary commands by exploiting improper pattern normalization in matchesExecAllowlistPattern. The vulnerability stems from lowercasing and overly permissive glob matching logic that incorrectly allows the ? wildcard to match across POSIX path segments, circumventing intended security restrictions. No public exploit identified at time of analysis, though CVSS 8.8 severity reflects network-accessible attack vector with no authentication required and high integrity/availability impact.
Authentication Bypass
-
CVE-2026-32972
HIGH
CVSS 7.1
Privilege escalation in OpenClaw versions prior to 2026.3.11 allows authenticated users with operator.write permissions to execute administrative browser profile management functions, bypassing role-based access controls. Attackers can persist malicious remote Chrome DevTools Protocol (CDP) endpoints to disk, enabling potential remote code execution or session hijacking without operator.admin privileges. EPSS data not available; no public exploit identified at time of analysis. CVSS 7.1 (High) reflects network-accessible attack requiring only low-privileged authentication.
Authentication Bypass
-
CVE-2026-32914
HIGH
CVSS 8.7
Privilege escalation in OpenClaw versions before 2026.3.12 allows authenticated users with command authorization to access owner-restricted configuration and debug endpoints due to missing permission checks. Attackers can read and modify privileged settings intended only for owners, effectively bypassing role-based access controls. CVSS 8.7 (High) with EPSS data unavailable; no public exploit identified at time of analysis, though the vulnerability class (CWE-863: incorrect authorization) is commonly targeted once disclosed.
Authentication Bypass
-
CVE-2026-5046
HIGH
CVSS 7.4
Stack-based buffer overflow in Tenda FH1201 router firmware 1.2.0.14(408) allows authenticated remote attackers to execute arbitrary code or cause denial of service via crafted 'GO' parameter to the /goform/WrlExtraSet endpoint. CVSS 8.8 reflects high impact but requires low-privilege authentication (PR:L). Publicly available exploit code exists, demonstrating concrete exploitability. EPSS data not provided, but the combination of available POC and network accessibility elevates real-world risk for internet-exposed devices with default or weak credentials.
Tenda
Buffer Overflow
Stack Overflow
-
CVE-2026-5045
HIGH
CVSS 7.4
Stack-based buffer overflow in Tenda FH1201 router (v1.2.0.14) enables remote authenticated attackers to execute arbitrary code via the WrlclientSet function. Exploitation requires only low-privilege credentials (CVSS PR:L) and has low attack complexity (AC:L), with publicly available exploit code on GitHub. CVSS 8.8 reflects high impact across confidentiality, integrity, and availability. No vendor patch identified at time of analysis, creating urgent risk for deployed devices.
Tenda
Buffer Overflow
Stack Overflow
-
CVE-2026-5044
HIGH
CVSS 7.4
Stack-based buffer overflow in Belkin F9K1122 router version 1.00.33 allows authenticated remote attackers to achieve full system compromise via the formSetSystemSettings endpoint. The vulnerability resides in the Setting Handler component's webpage parameter processing. Public exploit code is available on GitHub, significantly lowering the barrier to exploitation. With CVSS 8.8 (High) severity and low attack complexity, this represents a critical risk to affected devices, though no active exploitation has been confirmed by CISA KEV at time of analysis.
Buffer Overflow
Stack Overflow
-
CVE-2026-5043
HIGH
CVSS 7.4
Stack-based buffer overflow in Belkin F9K1122 router (firmware 1.00.33) enables authenticated remote attackers to achieve complete system compromise via the formSetPassword endpoint. The vulnerability affects the Parameter Handler component and permits code execution with high impact to confidentiality, integrity, and availability. Publicly available exploit code exists on GitHub, significantly lowering the barrier to exploitation. Vendor non-responsive to disclosure, indicating no official patch is available.
Buffer Overflow
Stack Overflow
-
CVE-2026-5042
HIGH
CVSS 7.4
Stack-based buffer overflow in Belkin F9K1122 router firmware 1.00.33 allows authenticated remote attackers to achieve arbitrary code execution via the formCrossBandSwitch parameter handler. Exploitation requires low-privilege authentication but no user interaction, with publicly available exploit code confirming proof-of-concept viability. EPSS data not available, but the combination of network attack vector, low complexity (AC:L), and public exploit represents elevated risk for internet-exposed devices. Vendor unresponsive to disclosure, indicating no official patch timeline.
Buffer Overflow
Stack Overflow
-
CVE-2026-5036
HIGH
CVSS 7.4
Stack-based buffer overflow in Tenda 4G06 router firmware version 04.06.01.29 allows authenticated remote attackers to achieve arbitrary code execution with high impact to confidentiality, integrity, and availability. The vulnerability resides in the fromDhcpListClient function accessible via the /goform/DhcpListClient endpoint, triggered by manipulating the 'page' parameter. Publicly available exploit code exists (GitHub PoC published), significantly lowering the barrier to exploitation. CVSS 8.8 (High) reflects network-based attack vector with low complexity, though low-privilege authentication is required. Not currently listed in CISA KEV, indicating no confirmed widespread active exploitation at time of analysis.
Tenda
Buffer Overflow
Stack Overflow
-
CVE-2026-5024
HIGH
CVSS 7.4
Stack-based buffer overflow in D-Link DIR-513 1.10 router's email configuration interface allows authenticated remote attackers to achieve arbitrary code execution with high impact to confidentiality, integrity, and availability. The vulnerability affects the formSetEmail function via manipulation of the curTime parameter. Publicly available exploit code exists on GitHub, significantly lowering the exploitation barrier. CRITICAL LIMITATION: This product reached end-of-life and receives no security updates from D-Link, making this a permanent risk for deployed devices. CVSS 8.8 with low attack complexity and CVSS:3.1 Exploit Maturity 'Proof-of-Concept' confirms immediate exploitability.
D-Link
Buffer Overflow
Stack Overflow
-
CVE-2026-5021
HIGH
CVSS 7.4
Stack-based buffer overflow in Tenda F453 router firmware 1.0.0.3 allows authenticated remote attackers to execute arbitrary code or crash the device via the PPTP user configuration interface. The vulnerability resides in the fromPPTPUserSetting function within the httpd component, triggered by manipulating the 'delno' parameter. Publicly available exploit code exists (GitHub), significantly lowering exploitation barriers. CVSS 8.8 reflects high impact across confidentiality, integrity, and availability, though authentication is required (PR:L). EPSS data not provided, but public POC availability elevates real-world risk for exposed management interfaces.
Tenda
Buffer Overflow
Stack Overflow
-
CVE-2026-4946
HIGH
CVSS 8.8
Command injection in NSA Ghidra (versions before 12.0.3) executes arbitrary commands when analysts click on maliciously crafted binary comments. Attackers embed @execute annotation directives in binary data (e.g., CFStrings in Mach-O files) that Ghidra auto-extracts and renders as clickable UI elements, bypassing the intended trust boundary for user-authored annotations. No public exploit identified at time of analysis, though the attack vector is well-documented in vendor advisory. EPSS data not available; CVSS 8.8 reflects high impact contingent on user interaction with a weaponized binary file.
Command Injection
-
CVE-2026-0562
HIGH
CVSS 8.3
Authenticated users in parisneo/lollms (versions before 2.2.0) can hijack friend requests intended for other users through an Insecure Direct Object Reference (IDOR) flaw in the `/api/friends/requests/{friendship_id}` endpoint. The vulnerability enables any logged-in user to accept or reject friendship requests by manipulating the `friendship_id` parameter without authorization checks, leading to unauthorized social graph manipulation and potential account compromise via social engineering. Fixed in version 2.2.0 with commit c462977; no public exploit identified at time of analysis, though the attack is trivially reproducible with standard HTTP tools given the low complexity (CVSS AC:L) and authenticated network access (CVSS AV:N/PR:L).
Authentication Bypass
-
CVE-2026-0560
HIGH
CVSS 7.5
Server-Side Request Forgery (SSRF) in parisneo/lollms versions before 2.2.0 allows unauthenticated remote attackers to make arbitrary HTTP requests to internal services and cloud metadata endpoints via the `/api/files/export-content` endpoint. The vulnerability stems from insufficient URL validation in the `_download_image_to_temp()` function, enabling internal network reconnaissance, access to cloud instance metadata (AWS/GCP/Azure), and potential remote code execution through server-side exploitation chains. EPSS data not available; no public exploit identified at time of analysis. Vendor-released patch available in commit 76a54f0 and version 2.2.0.
SSRF
RCE
Information Disclosure
-
CVE-2026-34210
MEDIUM
CVSS 6.0
Stripe PaymentIntent replay vulnerability in mppx payment handler allows attackers to bypass idempotency checks and consume resources by replaying captured Stripe credentials against new challenges without actual charges. The vulnerability affects mppx versions prior to 0.4.11, where the server failed to validate Stripe's Idempotent-Replayed response header during PaymentIntent creation, enabling unlimited resource consumption from a single valid payment credential.
Information Disclosure
-
CVE-2026-33574
MEDIUM
CVSS 5.8
OpenClaw before version 2026.3.8 allows local authenticated attackers to write files outside the intended tools directory through a time-of-check-time-of-use (TOCTOU) path traversal vulnerability in the skills download installer. An attacker with local access and low privileges can rebind the tools-root symbolic link or path between the initial validation check and the final archive extraction, causing the installer to write malicious files to arbitrary locations on the system. While the attack requires local access and moderate effort (high complexity), successful exploitation grants the attacker arbitrary file write capability with potential impact on system integrity and availability.
Path Traversal
-
CVE-2026-33572
MEDIUM
CVSS 6.8
OpenClaw before 2026.2.17 stores session transcript JSONL files with overly permissive default file permissions, enabling local authenticated users to read transcript contents and extract sensitive information including secrets from tool output. The vulnerability requires local access and authenticated status on the system, affecting confidentiality of cached session data. No public exploit code or active exploitation has been confirmed, though the attack surface is high given the local nature and ease of file access.
Information Disclosure
-
CVE-2026-32975
MEDIUM
CVSS 6.9
OpenClaw before version 2026.3.12 allows authentication bypass in Zalouser allowlist mode by matching mutable group display names instead of stable identifiers, enabling attackers to create identically-named groups and route messages from unauthorized groups to the agent. The vulnerability requires network access and no authentication, affecting the confidentiality and integrity of message routing with a CVSS score of 6.9. No public exploit code has been identified at time of analysis.
Authentication Bypass
-
CVE-2026-32924
MEDIUM
CVSS 6.9
OpenClaw before version 2026.3.12 permits authorization bypass in Feishu reaction event handling when chat_type parameters are omitted, causing group chat events to be misclassified as peer-to-peer conversations and allowing attackers to circumvent groupAllowFrom and requireMention security controls. Unauthenticated remote attackers can exploit this with low complexity to achieve partial confidentiality and integrity impacts. No public exploit code has been identified, but the vulnerability is straightforward to trigger once the root cause is understood.
Authentication Bypass
-
CVE-2026-32923
MEDIUM
CVSS 5.3
OpenClaw before version 2026.3.11 allows authenticated non-allowlisted Discord guild members to bypass authorization checks on reaction ingestion events, enabling them to inject arbitrary reaction text into downstream session context that is trusted as legitimate system events. This authentication-required authorization bypass affects all OpenClaw deployments integrating Discord guild reaction handling and has a CVSS score of 5.3 with confirmed patch availability.
Authentication Bypass
-
CVE-2026-32919
MEDIUM
CVSS 6.9
OpenClaw before version 2026.3.11 allows authenticated operators with write-scoped permissions to bypass authorization controls and execute admin-only session reset functionality. Attackers holding operator.write privileges can issue agent requests containing /new or /reset slash commands to reset conversation state without requiring operator.admin credentials, resulting in unauthorized modification of session data. This vulnerability has a CVSS score of 6.9 and affects the core authorization logic that protects sensitive administrative operations.
Authentication Bypass
-
CVE-2026-5101
MEDIUM
CVSS 5.3
Command injection in Totolink A3300R firmware versions up to 17.0.0cu.557_b20221024 allows authenticated remote attackers to execute arbitrary commands via the lanIp parameter in the setLanCfg function of /cgi-bin/cstecgi.cgi. Publicly available exploit code exists for this vulnerability. With a CVSS score of 5.3 and moderate real-world exploitability, this presents a meaningful risk to affected router installations.
Command Injection
-
CVE-2026-5041
MEDIUM
CVSS 5.1
Command injection in code-projects Chamber of Commerce Membership Management System 1.0 allows authenticated remote attackers with high privileges to execute arbitrary commands via manipulation of the mailSubject and mailMessage parameters in the admin/pageMail.php file. The vulnerability has a publicly available exploit and a moderate CVSS score of 4.7, but real-world risk is constrained by the requirement for high-privilege authenticated access.
PHP
Command Injection
-
CVE-2026-5037
MEDIUM
CVSS 4.8
Stack-based buffer overflow in mxml up to version 4.0.4 allows local authenticated attackers to cause a denial of service by manipulating the tempr argument in the index_sort function within mxmlIndexNew. The vulnerability has a low CVSS score of 3.3 due to local-only attack vector and denial-of-service impact, but publicly available exploit code exists and a vendor patch has been released.
Buffer Overflow
Stack Overflow
-
CVE-2026-5035
MEDIUM
CVSS 6.9
SQL injection in code-projects Accounting System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL queries via the en_id parameter in /view_work.php, potentially leading to unauthorized data access, modification, or deletion. Public exploit code is available, increasing practical exploitation risk despite the moderate CVSS score of 6.9.
PHP
SQLi
-
CVE-2026-5034
MEDIUM
CVSS 6.9
SQL injection in code-projects Accounting System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the cos_id parameter in /edit_costumer.php. The vulnerability has a CVSS 4.0 score of 6.9 with low impact to confidentiality, integrity, and availability. Publicly available exploit code exists, elevating real-world risk despite moderate CVSS severity.
SQLi
PHP
-
CVE-2026-5033
MEDIUM
CVSS 6.9
SQL injection in code-projects Accounting System 1.0 allows unauthenticated remote attackers to extract, modify, or delete database contents via the cos_id parameter in /view_costumer.php. Publicly available exploit code exists (GitHub POC published), enabling trivial exploitation with no authentication required. CVSS 7.3 reflects high exploitability (AV:N/AC:L/PR:N) with partial impact across confidentiality, integrity, and availability. No vendor-released patch identified at time of analysis.
PHP
SQLi
-
CVE-2026-5031
MEDIUM
CVSS 5.3
BichitroGan ISP Billing Software 2025.3.20 contains an improper resource identifier control vulnerability in the settings/users-view endpoint that allows authenticated remote attackers to disclose sensitive information via manipulation of the ID parameter. The vulnerability has a CVSS score of 4.3 with publicly available exploit code; the vendor has not responded to disclosure attempts.
Information Disclosure
-
CVE-2026-5030
MEDIUM
CVSS 5.3
Command injection in Totolink NR1800X firmware 9.1.0u.6279_B20210910 allows authenticated remote attackers to execute arbitrary commands via the host_time parameter in the NTPSyncWithHost function of /cgi-bin/cstecgi.cgi. The vulnerability has a CVSS score of 6.3 (medium severity) with publicly available exploit code, though it requires valid login credentials to exploit. Real-world risk is moderate given the authentication requirement and moderate EPSS probability (indicated by E:P in vector).
Command Injection
-
CVE-2026-5023
MEDIUM
CVSS 4.8
OS command injection in DeDeveloper23 codebase-mcp allows local authenticated attackers to execute arbitrary system commands through the getCodebase, getRemoteCodebase, and saveCodebase functions in src/tools/codebase.ts. The vulnerability affects all versions up to commit 3ec749d237dd8eabbeef48657cf917275792fde6, with publicly available exploit code disclosed via GitHub issue #7. Given the local attack requirement and authenticated privilege escalation prerequisite (PR:L), real-world exploitation requires an already-compromised local account with legitimate tool access, though EPSS score of 5.3 reflects moderate practical risk in shared development environments.
Command Injection
-
CVE-2026-5020
MEDIUM
CVSS 5.3
Command injection in Totolink A3600R firmware 4.1.2cu.5182_B20201102 allows authenticated remote attackers to execute arbitrary commands via the NoticeUrl parameter in the setNoticeCfg function of /cgi-bin/cstecgi.cgi. The vulnerability has a CVSS score of 6.3 (low-to-medium severity) but is confirmed by publicly available exploit code, making it an active threat to deployed devices despite the authentication requirement.
Command Injection
-
CVE-2026-2602
MEDIUM
CVSS 6.4
Stored cross-site scripting (XSS) in Twentig Supercharged Block Editor plugin for WordPress versions up to 1.9.7 allows authenticated attackers with Contributor-level or higher privileges to inject arbitrary JavaScript via the 'featuredImageSizeWidth' parameter, which executes in the browsers of all users who view affected pages. The vulnerability stems from insufficient input sanitization and output escaping. No public exploit code or active exploitation has been confirmed at the time of analysis.
WordPress
XSS
-
CVE-2026-34224
LOW
CVSS 2.1
Parse Server allows attackers with a valid authentication provider token and a single MFA recovery code or SMS one-time password to create multiple concurrent authenticated sessions, bypassing the single-use guarantee of MFA recovery codes and defeating session revocation. The vulnerability exploits a race condition in the authData login endpoint where concurrent requests can reuse the same MFA token before database synchronization occurs, enabling persistent unauthorized access even after legitimate session revocation.
Information Disclosure
-
CVE-2026-23400
None
Deadlock in Linux kernel rust_binder driver occurs when BC_DEAD_BINDER_DONE is invoked on a non-looper thread while the proc lock is held, preventing push_work_if_looper() from safely acquiring the proc lock for work queue delivery. The vulnerability affects the Rust implementation of Android's Binder IPC mechanism and can cause kernel deadlock, potentially resulting in denial of service to affected processes or the entire system depending on thread scheduling.
Linux
Linux Kernel
Rust
Android
Denial Of Service