IONIX THREAT CENTER

CVE-2026-56028 is a critical unauthenticated privilege escalation vulnerability in the Easy Elements for Elementor – Addons & Website Templates WordPress plugin by themewant, affecting all versions up to and including 1.4.9. With a CVSS score of 9.8 (Critical), the flaw allows any unauthenticated remote attacker to create a WordPress account with full administrator privileges, leading to complete site takeover with no credentials or user interaction required.

CVE-2026-56036 is a critical unauthenticated SQL injection vulnerability in 워드프레스 결제 심플페이 (WordPress Payment SimplePay), a WooCommerce payment gateway plugin developed by codemstory (WordPress.org slug: pgall-for-woocommerce). The flaw affects all plugin versions up to and including 5.5.6 and carries a CVSS v3.1 base score of 9.3 (Critical), enabling remote, unauthenticated attackers to inject arbitrary SQL statements and exfiltrate sensitive data directly from the underlying WordPress database.

CVE-2026-56070 is a critical unauthenticated SQL injection vulnerability in ThemeHunk's Advance Product Search plugin for WordPress and WooCommerce, affecting all versions up to and including 1.4.4. With a CVSS score of 9.3 (Critical), the flaw allows any remote, unauthenticated attacker to inject arbitrary SQL commands and extract sensitive data from the underlying WordPress database — no privileges or user interaction are required. The plugin has over 10,000 active installations on public-facing WooCommerce stores.

CVE-2026-54350 is a critical unauthenticated NoSQL operator injection vulnerability in Budibase, the open-source low-code platform, affecting all versions prior to 3.39.12. By injecting JSON metacharacters into published-app query parameters, an unauthenticated attacker can override the builder-defined database filter and read or overwrite every document in the backing collection with a single HTTP request. The vulnerability carries a CVSS v3.1 base score of 10.0 (Critical).

CVE-2026-49869 is a critical (CVSS 10.0) unauthenticated Remote Code Execution vulnerability in Kestra, an open-source event-driven workflow orchestration platform. The flaw resides in Kestra's AuthenticationFilter, where a suffix-based path check used to whitelist the public configuration endpoint can be trivially abused to bypass Basic Auth on any API path — enabling unauthenticated workflow creation and execution. Because Kestra ships with shell and script execution plugins enabled by default, this authentication bypass directly and immediately results in unauthenticated RCE as root inside the Kestra worker container.

CVE-2026-28701 is a critical path traversal vulnerability (CWE-22) in Daktronics VFC-DMP-5000, DMP-5000, and DMP-8000 controller firmware, carrying a CVSS v3.1 score of 9.8 (CRITICAL). The flaw allows both unauthenticated and authenticated remote users to escape the intended directory and enumerate arbitrary file system paths via the device's HTTP-accessible web management interface. CISA issued ICS advisory ICSA-26-176-04 for this vulnerability, noting that this flaw — in combination with companion vulnerabilities disclosed in the same advisory — could provide an unauthenticated attacker with complete root-level access and control of the system.

CVE-2026-56067 is a critical unauthenticated SQL Injection vulnerability in the JetSmartFilters WordPress plugin (by Crocoblock/Jetimpex Inc.), affecting all versions up to and including 3.8.3. The flaw requires no credentials or user interaction to exploit, allowing any remote attacker to interact directly with the underlying WordPress database. It carries a CVSS v3.1 base score of 9.3 (Critical) and was publicly disclosed on June 26, 2026.

CVE-2026-42208 is a critical pre‑authentication SQL injection in the LiteLLM proxy (AI Gateway). The vulnerability exists in how the proxy constructs a database query used during API‑key verification: caller-supplied key data was incorporated directly into query text instead of being passed as a parameter. An attacker can reach this code path by sending a specially crafted Authorization header to any LLM API route (for example, POST /chat/completions) and trigger the proxy's error handling to exercise the vulnerable query.

CVE-2026-56068 is a critical unauthenticated SQL injection vulnerability in the JetEngine WordPress plugin by Crocoblock (Jetimpex Inc.), affecting all versions up to and including 3.8.10.2. The flaw falls under CWE-89 (Improper Neutralization of Special Elements Used in an SQL Command) and carries a CVSS v3.1 base score of 9.3 (Critical), enabling any unauthenticated remote attacker to directly interact with the underlying WordPress database and exfiltrate sensitive data.

CVE-2026-56033 is a critical unauthenticated privilege escalation vulnerability in the Dokan Pro WordPress plugin, affecting all versions up to and including 5.0.4. With a CVSS v3.1 score of 9.8 (Critical), the flaw allows any remote, unauthenticated attacker to escalate their privileges on an affected WordPress site with no user interaction required. Sites running Dokan Pro as a WooCommerce multivendor marketplace are directly at risk of complete administrative compromise.

CVE-2026-54836 is a critical, unauthenticated SQL Injection vulnerability (CWE-89) in the YMC Filter WordPress plugin (slug: ymc-smart-filter), affecting all versions up to and including 3.11.5. It carries a CVSS 3.1 score of 9.3 (Critical), is exploitable over the network with no authentication or user interaction required, and is capable of extracting database contents beyond the plugin's own data scope due to a confirmed Scope Change in the CVSS vector.

CVE-2026-41120 is a critical-severity vulnerability in Dell Wyse Management Suite (WMS), an on-premises enterprise thin-client management platform, affecting all versions prior to WMS 5.5 HF1. The flaw is classified as "Acceptance of Extraneous Untrusted Data With Trusted Data" and can be exploited by a remote, unauthenticated attacker to achieve Remote Code Execution (RCE) on the underlying server. With a CVSS v3.1 base score of 9.8, this vulnerability represents a full-impact risk to confidentiality, integrity, and availability of affected systems.

CVE-2026-57700 is a critical Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) in OMGF Pro, a premium WordPress plugin by Daan.Dev that enables GDPR-compliant local hosting of Google Fonts. The flaw affects all versions of OMGF Pro through 5.2.6 and carries a maximum CVSS 3.1 base score of 10.0 (Critical), reflecting unauthenticated remote exploitability with complete impact across confidentiality, integrity, and availability. A patched release (version 5.2.7) was published by the vendor on June 25, 2026.

CVE-2026-54088 is a critical pre-authentication OS command injection vulnerability in File Browser (filebrowser/filebrowser), a widely deployed open-source web-based file management interface. The flaw exists in the Hook Authentication feature, where user-supplied credentials are interpolated into shell command strings using os.Expand without any sanitization, allowing an unauthenticated remote attacker to execute arbitrary OS commands on the server before authentication takes place. This vulnerability carries a CVSS 4.0 score of 9.3 (Critical) and is fixed in version 2.63.6.

CVE-2026-57878 is a critical unauthenticated stack-based buffer overflow vulnerability in the thttpd embedded web server running on GeoVision GV-LPC2011 and GV-LPC2211 License Plate Recognition (LPR) IP cameras running firmware V1.12 and earlier. A remote, unauthenticated attacker can exploit this flaw by sending a single crafted HTTP request to the camera's web interface, with no credentials or user interaction required, potentially leading to arbitrary code execution (RCE). The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical).

CVE-2026-39893 is a critical pre-authentication SQL injection vulnerability in Cacti, an open source performance and fault management framework, affecting all versions up to and including 1.2.30. The flaw resides in graph_view.php, where the rfilter request variable is concatenated directly into an SQL RLIKE clause without sanitization, and is reachable without credentials on any Cacti deployment with guest graph viewing enabled. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) and was fixed in version 1.2.31.

CVE-2026-39938 is a critical-severity (CVSS 9.8) unauthenticated Local File Inclusion (LFI) vulnerability in Cacti, the open source performance and fault management framework. Affecting all versions up to and including 1.2.30, the flaw is exploitable remotely without credentials or user interaction, and has been assigned both CWE-22 (Path Traversal) and CWE-78 (OS Command Injection), meaning successful exploitation can escalate beyond file disclosure to full Remote Code Execution. Cacti 1.2.31 resolves this issue.

CVE-2026-39955 is a critical pre-authentication SQL injection vulnerability affecting Cacti, the open-source network performance and fault management framework, in all versions up to and including 1.2.30. The flaw arises from an unanchored FILTER_VALIDATE_REGEXP validation in graph_view.php, allowing unauthenticated remote attackers to inject arbitrary SQL commands via the rfilter parameter. A patch was released in version 1.2.31, and immediate upgrade is strongly recommended.

CVE-2026-39948 is a critical unauthenticated SQL injection vulnerability (CWE-89) in Cacti, an open-source network performance and fault management framework, affecting all versions 1.2.30 and prior. The flaw is reachable pre-authentication through graph_view.php on installations with guest graph viewing enabled, allowing a remote attacker with no credentials to inject arbitrary SQL and compromise the confidentiality and integrity of the underlying database. The vulnerability carries a CVSS 4.0 score of 9.3 (Critical).

CVE-2026-3055 is a critical out-of-bounds memory read vulnerability (CWE-125) in Citrix NetScaler ADC and NetScaler Gateway, rated CRITICAL with a CVSS 4.0 score of 9.3 and a CVSS 3.1 score of 9.8. The flaw resides in the SAML Identity Provider (SAML IDP) component and allows unauthenticated, remote attackers to trigger memory overread, potentially extracting active session tokens and sensitive credentials directly from appliance memory. CISA added CVE-2026-3055 to its Known Exploited Vulnerabilities (KEV) catalog on March 30, 2026, with a remediation due date of April 2, 2026, confirming active exploitation…