IONIX THREAT CENTER

CVE-2026-94293 is a critical Missing Authentication for Critical Function (CWE-306) vulnerability affecting the Murrelektronik Software AAS Edge Client, an open-source Asset Administration Shell (AAS) reference client originally built as a trade-fair demonstrator. The client's REST API binds to all network interfaces on TCP port 18000, performs no authentication, and accepts cross-origin requests from any origin, allowing any unauthenticated network attacker to read and modify AAS submodel data. The vulnerability affects all released versions of the product and carries a CVSS v3.1 base score of 9.8 (Critical).

CVE-2026-105484 is a critical, unauthenticated OS command injection vulnerability in the firmware upload handler of the TOTOLINK X6000R wireless router. The flaw resides in the firmware_check function of the UploadFirmwareFile handler, reachable via /cgi-bin/cstecgi.cgi, and allows a remote attacker to execute arbitrary operating system commands on the device without any authentication. The issue is rated CRITICAL with a maximum CVSS v3.1 base score of 10.0.

CVE-2026-21589 is a critical path traversal vulnerability affecting Atlassian Bamboo Data Center and Server (along with several other Atlassian Data Center/Server products). An unauthenticated remote attacker who knows the exact name and path of a target file can retrieve files from within the web application root directory. Atlassian rates this vulnerability as Critical with a CVSS score of 9.3.

CVE-2026-77226 is a critical incorrect-authorization vulnerability (CWE-863) affecting the Admin web application of Camunda 7. The flaw resides in the SetupResource first-run setup endpoint, which miscalculates whether an administrator already exists in the system, allowing an unauthenticated remote attacker to create a new administrator account under certain conditions. The issue carries a CVSS v4.0 base score of 9.2 (Critical) and can lead to full account takeover.

CVE-2026-103352 is a critical, unauthenticated blind SQL injection vulnerability in the WP BASE Booking plugin for WordPress (wp-base-booking-of-appointments-services-and-events), affecting all versions up to and including 6.4.0. The flaw stems from improper neutralization of special elements used in SQL commands (CWE-89), allowing a remote attacker to inject SQL statements without any authentication or user interaction. It carries a CVSS v3.1 base score of 9.3 (Critical) and was fixed in version 6.5.0.

CVE-2026-105638 is a critical authentication vulnerability in Plane, the open-source project management platform, affecting versions prior to 1.4.0. The magic-code (email OTP) sign-in and sign-up verification endpoints lacked any per-code failed-attempt tracking and bypassed Django REST Framework's built-in rate throttling, allowing an unauthenticated attacker who knows a victim's email address to brute-force the six-digit login code within its validity window and take over the account. The flaw carries a CVSS v3.1 base score of 9.1 (Critical).

CVE-2026-105639 is a critical authentication and authorization bypass vulnerability in Plane, the open-source project management platform maintained by makeplane. An unauthenticated attacker who knows a target's email address can hijack a pending workspace invitation intended for that victim, gaining unauthorized membership in the workspace at the invited role level — up to full Admin control. The flaw carries a CVSS v3.1 base score of 9.8 (Critical) and affects all versions up to and including 1.3.1.

CVE-2026-105641 is a critical use of hard-coded credentials (CWE-798) vulnerability affecting Plane, an open-source project management platform maintained by makeplane. Community (self-hosted) deployment manifests for versions prior to 1.4.0 shipped with fixed, publicly known default values for the Django SECRET_KEY and the LIVE_SERVER_SECRET_KEY, which remained active unless an operator manually overrode them. Because these keys underpin session signing and live-collaboration authentication, their disclosure allows a remote, unauthenticated attacker to forge valid sessions and bypass authentication entirely.

CVE-2026-105640 is a critical authentication bypass vulnerability in Plane, the open-source project management platform by makeplane, affecting all versions prior to 1.4.0. The flaw stems from Plane trusting email addresses returned by Gitea OAuth and by self-managed GitLab OAuth without verifying that the provider confirmed ownership of that email, allowing an attacker to take over an existing victim account. The issue carries a CVSS v3.1 base score of 9.1 (Critical).

CVE-2026-102428 is a critical, unauthenticated SQL injection vulnerability in the OrdaSoft Joomla CCK extension (component com_os_cck) for Joomla. The flaw stems from improper validation of a user-supplied "order column" parameter used in record sorting, allowing attackers to inject arbitrary SQL without any authentication. The issue is rated 9.3 (Critical) and is remotely exploitable over the network.

CVE-2026-92931 is a critical Server-Side Request Forgery (SSRF) vulnerability in Progress Software's @progress/sitefinity-nextjs-sdk npm package, the official SDK used to build Next.js-based front ends for Sitefinity CMS. The flaw allows a remote, unauthenticated attacker to force the server to issue requests to an attacker-controlled host, potentially exposing sensitive internal information. The issue carries the maximum CVSS v3.1 base score of 10.0 (Critical).

CVE-2026-105285 is a critical stack-based buffer overflow in the QoS Rule Handler of TOTOLINK A3002MU routers running firmware 1.0.0-B20230403.1455. The flaw resides in the /boafrm/formIpQoS endpoint and can be triggered remotely over the network with no authentication, allowing an attacker to crash the device's management interface or potentially achieve arbitrary code execution as root. The issue has been assigned a maximum CVSS v3.1 base score of 10.0.

CVE-2026-105284 is a critical improper-authorization (CWE-285) vulnerability in the TOTOLINK A3002MU wireless router, firmware version 1.0.0-B20230403.1455. A flaw in the /bin/boa web server's authentication-check routine (sub_40FCFC) allows a remote, unauthenticated attacker to bypass session verification entirely and reach administrative and diagnostic request handlers. The issue carries the maximum CVSS score of 10.0 and is rated critical.

CVE-2026-103510 is an authentication bypass vulnerability in Perforce P4 Search, the search component bundled with P4 (Helix Core). The component fails to fail securely when its service authentication token is left blank, allowing an unauthenticated, network-based attacker to obtain the highest application privilege within P4 Search. This can lead to full compromise of P4 Search and the connected P4 Server, and Perforce has rated the issue Critical (CVSS 9.5).

CVE-2026-100103 is a critical authentication bypass vulnerability affecting Perforce P4Search container images, a component of Perforce Helix Core (P4). Affected container images reset the service authentication token to a publicly documented default value, allowing an unauthenticated network attacker to obtain the highest application privilege within P4Search. This can potentially lead to arbitrary code execution and compromise of the connected P4 Server, and carries a maximum CVSS score of 10.0.

CVE-2026-105215 is a critical authentication bypass (CWE-290, Authentication Bypass by Spoofing) affecting ZITADEL's hosted Login V1 UI. The registration endpoint used when an external identity is "not found" accepts client-supplied external identity fields (IdP config ID and external user ID) without requiring a completed, verified IdP callback, allowing an unauthenticated attacker to pre-create an account bound to a victim's external identity. The flaw carries a CVSS score of 9.3 and affects ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2.

CVE-2026-105207 is a critical missing-authentication vulnerability in ZITADEL, an open-source identity and access management platform. ZITADEL links user accounts to external identity providers (IdPs) without verifying a primary authentication factor or the caller's permission to make that link, both in "identify-only" Login V2 sessions and via the User Service V2 AddIDPLink API endpoint. An attacker who knows only a victim's login name can exploit this to bind their own external IdP identity to the victim's account and sign in as that victim, resulting in full account takeover.

CVE-2026-105211 is an authentication bypass vulnerability in ZITADEL's Login V2 UI that allows an unauthenticated attacker who knows only a victim's login name to obtain a fully MFA-authenticated session. The flaw stems from the returnCode OTP delivery type returning one-time passcodes directly in the HTTP response instead of sending them out-of-band, letting the attacker complete both OTP factors without any credentials. Exploitation can lead to full account takeover, including compromise of administrator accounts and the underlying ZITADEL instance.

CVE-2026-103355 is a critical, unauthenticated blind SQL injection vulnerability in the Unlimited Elements For Elementor WordPress plugin (Free Widgets, Addons, Templates), affecting all versions up to and including 2.0.20. The flaw stems from insufficient sanitization of special characters in a database query, allowing a remote attacker to manipulate SQL statements without any credentials. It carries a CVSS v3.1 base score of 9.3 (Critical).

CVE-2026-105134 is a critical, unauthenticated OS command injection vulnerability in Ahsay AhsayCBS, a backup management console used by managed service providers to administer Ahsay backup environments. The flaw resides in the Replication Receiver component and allows a remote attacker to execute arbitrary operating system commands on the underlying server without credentials or user interaction. The issue carries a maximum CVSS v3.1 base score of 10.0 and affects AhsayCBS versions up to 10.3.2.

CVE-2026-105135 is a critical code injection vulnerability in InternLM MindSearch version 0.1.0, affecting the ExecutionAction.run function in the Planner Agent component (mindsearch/agent/graph.py). Manipulation of input arguments allows an attacker to inject and execute arbitrary code, and the flaw can be triggered remotely over the network with no authentication or user interaction required. The vulnerability carries the maximum CVSS v3.1 base score of 10.0 (Critical).

CVE-2026-92084 is a critical unauthenticated arbitrary shortcode execution vulnerability (CWE-94, Improper Control of Generation of Code) affecting the Beaver Builder Page Builder plugin for WordPress, including its free "Lite" edition. The plugin fails to properly validate input before passing it to WordPress's do_shortcode function when rendering a Sidebar module, allowing unauthenticated attackers to execute arbitrary shortcodes on the site. The issue carries a CVSS v3.1 base score of 9.1 (Critical).