IONIX THREAT CENTER

CVE-2026-108587 is an unauthenticated arbitrary file upload vulnerability (CWE-434) in the 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress. It affects all versions up to and including 2.34.10 and can lead to remote code execution. The CVSS v3.1 base score is 9.8 (Critical).

CVE-2026-93483 is an authentication bypass vulnerability in Znuny systems configured with HTTPBasicAuth. An unauthenticated remote attacker can log in as any existing agent or customer user by sending a request with a forged Remote-User HTTP header, without providing credentials. The CVE record rates it CRITICAL (CVSS v4.0 score 9.5).

CVE-2026-110911 is a critical SQL injection vulnerability (CWE-89) in the Wheels framework, affecting versions 1.1.8 through 4.1.1. Applications that pass request-supplied data to certain Wheels data-access APIs can be manipulated by unauthenticated remote attackers. The CVSS v3.1 base score is 9.8 (Critical).

CVE-2026-110864 is an authentication bypass vulnerability (CWE-287, Improper Authentication) in the OAuth Proxy plugin of Better Auth (npm package better-auth). Unauthenticated attackers can sign in as other users by forging encrypted profiles. The CVE record lists a CVSS v4.0 score of 9.1 (Critical).

CVE-2026-110862 is a critical authentication bypass vulnerability (CWE-287, Improper Authentication) in Better Auth, versions 1.4.0-beta.18 before 1.7.7. An unauthenticated remote attacker who knows a victim's email address can sign in as that user by reusing an OAuth state value as a Magic Link token. The CVSS v4.0 score is 9.3 (Critical).

CVE-2026-108336 is a critical authentication bypass vulnerability in Hitachi Vantara Remote Ops Agent, caused by the use of a default self-signed SSL certificate (CWE-321, use of a hard-coded cryptographic key). When the default certificate is in use, an attacker can sign JWT access tokens and bypass login, gaining unauthorized administrative access. The CVE record rates it 9.1 (Critical).

CVE-2026-108335 is a weak password recovery vulnerability (CWE-640) in the Web Interface module of Hitachi Vantara Remote Ops Agent. When the password reset functionality is enabled and email is configured, an unauthenticated attacker could take over any account, including administrative accounts, by brute-forcing the password reset code. The CVE record rates it Critical (9.1).

CVE-2026-101980 is an Integer Underflow vulnerability in the kernel of Juniper Networks Junos OS when Extended Echo is configured. An unauthenticated, network-based attacker can cause a denial of service through a kernel crash. The CVE record rates it CVSS v3.1 9.8 (Critical).

CVE-2026-55684 is a critical unauthenticated SQL injection vulnerability (CWE-89) in WeGIA, a web manager for charitable institutions. A remote attacker can execute arbitrary SQL through the html/socio/sistema/cadastro_cobrancas_geracao.php endpoint. The CVSS v3.1 base score is 9.8 (Critical).

CVE-2026-55680 is an unauthenticated SQL injection vulnerability (CWE-89) in WeGIA, a web application from LabRedesCefetRJ. It affects all versions before 3.8.6 and has a critical CVSS v3.1 score of 9.8. A remote attacker can run arbitrary SQL against the application database without logging in.

CVE-2026-55683 is a critical unauthenticated SQL injection vulnerability (CWE-89) in WeGIA, an open-source web manager for charitable institutions developed by LabRedesCefetRJ. It affects all versions prior to 3.8.6 and has a CVSS v3.1 base score of 9.8 (Critical). It is fixed in version 3.8.6.

CVE-2026-78802 is a code injection vulnerability (CWE-94) in the SKYWORTH DIGITAL SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M), firmware V1.0.3. A remote attacker can execute arbitrary code on the device. The CVE record rates it Critical (CVSS 9.8).

CVE-2024-34320 is an incorrect access control vulnerability (CWE-284) in sensitive API endpoints of ProPhoenix Law RMS v2022.2403.3.101. It is rated Critical (CVSS 9.8). The CVE record describes it as network-exploitable without privileges or user interaction.

CVE-2026-33792 is a critical stack-based buffer overflow (CWE-121) in the srxpfe process of Juniper Networks Junos OS on SRX Series devices. An unauthenticated network attacker can send a crafted packet to execute code as root or cause a denial of service. The CVSS v3.1 base score is 9.8 (Critical).

CVE-2026-33789 is a critical stack-based buffer overflow (CWE-121) in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. An unauthenticated BGP peer can cause a denial of service and potentially root-level command execution when the BGP Monitoring Protocol (BMP) is active. The CVSS v3.1 base score is 9.8 (Critical).

CVE-2026-102182 is a stack-based buffer overflow in the kmd component of Juniper Networks Junos OS on MX Series devices. An unauthenticated network attacker can execute code as root by sending specific IKE certificate-based packets. The CVSS v3.1 base score is 9.8 (Critical).

CVE-2026-110770 is an authentication bypass vulnerability in Databasus. The password reset endpoint lets unauthenticated attackers brute-force reset codes and take over accounts, including administrative accounts. It affects Databasus 3.7.0 through 3.61.0.

CVE-2026-102748 is a critical missing-authentication vulnerability (CWE-306, CWE-862) in Dgraph, the open source distributed GraphQL database. Dgraph Zero exposes administrative HTTP routes on port 6080 without authentication in all versions before 25.4.0. The CVSS v4.0 base score is 9.2 (Critical).

CVE-2026-110536 is an OS command injection vulnerability (CWE-78) in the HNAP CGI handler of the D-Link DIR-868L router, firmware version 2.01b05. It is rated critical, with a CVSS score of 10.0. It is reachable over the network without authentication or user interaction.

CVE-2026-55572 is a critical SQL injection vulnerability (CWE-89) in the alt_auth plugin of the e107 CMS. An unauthenticated remote attacker can inject SQL through the login username field. The CVSS v3.1 base score is 10.0 (Critical).