IONIX THREAT CENTER

CVE-2026-45063 is a critical authentication bypass (identity spoofing) vulnerability in the X509Authenticator component of the Symfony PHP framework, rated CVSS 4.0: 9.1 (Critical). An attacker who can obtain a certificate signed by a CA trusted by the target application can craft the certificate's CN field to embed a victim's email address, causing Symfony to authenticate the attacker as the victim. All Symfony applications using mTLS client-certificate authentication via X509Authenticator and running versions prior to 5.4.52, 6.4.40, 7.4.12, or 8.0.12 are affected.

CVE-2026-58644 is a critical Remote Code Execution (RCE) vulnerability in Microsoft SharePoint Server, rooted in insecure deserialization of untrusted data (CWE-502). The flaw affects Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition, and carries a CVSS v3.1 base score of 9.8 (Critical). Because it requires no authentication and no user interaction, any internet-exposed SharePoint instance running a vulnerable version is at risk of full remote code execution by an unauthenticated attacker.

CVE-2026-50522 is a critical deserialization vulnerability in Microsoft SharePoint Server, affecting Enterprise Server 2016, Server 2019, and the Subscription Edition. The flaw arises from insecure deserialization of untrusted data (CWE-502), enabling unauthorized remote attackers to execute arbitrary code over the network with no authentication and no user interaction required. It carries a CVSS v3.1 base score of 9.8 (Critical), representing a maximum-severity risk for any internet-facing SharePoint deployment.

CVE-2026-59083 is a critical-severity (CVSS 9.1) Improper Handling of URL Encoding vulnerability in Apache Tomcat's RewriteValve component, publicly disclosed on July 14, 2026. The flaw allows unauthenticated, remote attackers to bypass security constraints in affected configurations by sending specially crafted HTTP requests that exploit incorrect URL decoding behavior in the RewriteValve. The vulnerability spans four major version branches of Apache Tomcat, covering the vast majority of active deployments.

CVE-2026-62422 is a maximum-severity authentication bypass vulnerability (CVSS 10.0) in JetBrains YouTrack Server, classified under CWE-306 (Missing Authentication for Critical Function). The flaw allows unauthenticated remote attackers to bypass authentication through direct database access, granting full administrative control over the affected YouTrack instance. Six major version lines spanning 2024.2 through 2026.1 are affected, and JetBrains has released patched builds across all supported branches.

CVE-2026-61500 is a critical unauthenticated remote code execution vulnerability in Rejetto HFS (HTTP File Server) versions 3.0.0 through 3.2.0, scoring 9.3 (CRITICAL) under CVSS v4.0. The flaw stems from the application deriving its session-cookie signing key from JavaScript's non-cryptographic Math.random() generator while simultaneously leaking outputs of that same generator to unauthenticated clients during the login flow. An attacker can exploit this entirely over the network, with no credentials required, to forge an administrator session cookie and achieve remote code execution.

CVE-2026-27690 is a critical HTTP Request Smuggling vulnerability (CWE-444) in SAP Approuter (@sap/approuter), the Node.js-based reverse proxy and primary entry point for applications deployed on SAP Business Technology Platform (SAP BTP). Rated 9.1 (Critical) on the CVSS v3.1 scale, the flaw allows an unauthenticated remote attacker to send a specially crafted HTTP request that causes request-response desynchronization, resulting in exposure of other users' responses and potential service unavailability. All versions of the @sap/approuter npm package below 20.10.0 are affected; SAP has released version 20.10.0 as the fix.

CVE-2026-44761 is a critical default credentials vulnerability (CWE-1392) in SAP Commerce Cloud, affecting versions HY_COM 2205, COM_CLOUD 2211, and COM_CLOUD 2211-JDK21. SAP has assigned this a CVSS 3.1 base score of 9.1 (Critical). The platform may retain a sample OAuth2 client whose credentials are publicly documented in SAP Help Portal documentation; if left unchanged following deployment — a common misconfiguration — an unauthenticated remote attacker can use those well-known credentials to obtain a valid OAuth2 access token and invoke authenticated APIs to read and modify business-critical e-commerce data.

CVE-2026-62327 is a critical unauthenticated information disclosure vulnerability in 9Router (by decolua), a self-hosted Next.js-based AI provider routing dashboard, affecting all versions through 0.4.41. The flaw allows any remote attacker to retrieve full plaintext API keys for all connected AI provider accounts by sending a single unauthenticated HTTP request to the /api/usage/stats endpoint. With a CVSS 4.0 score of 9.3 (and a CVSS 3.1 score of 10.0), exploitation requires no credentials, no privileges, and no user interaction.

CVE-2026-59801 is a critical missing authentication vulnerability (CWE-306) in 9Router, a Next.js-based AI routing gateway developed by decolua, affecting all versions through 0.4.41. The flaw allows unauthenticated remote attackers to fully interact with provider management and usage API endpoints — enabling theft of plaintext API keys and OAuth tokens, redirection of AI traffic to attacker-controlled servers, exfiltration of conversation histories, and complete denial of service through provider deletion. The vulnerability carries a CVSS 3.1 score of 9.8 (Critical).

CVE-2026-15089 is a critical security vulnerability in the Drupal Commerce guest registration contributed module, affecting all released versions. The Drupal security team issued advisory SA-CONTRIB-2026-079 classifying this as Critical — Unsupported, indicating the module maintainer has not addressed the issue and no patch will be provided. The CVE record assigns a CVSS 3.1 base score of 9.1 with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N; note that NVD's independent assessment of this score is not yet complete.

CVE-2026-55810 is a critical PHP Object Injection vulnerability in the Drupal contributed module Plotly.js Graphing, affecting all versions prior to 3.0.2. Disclosed via Drupal Security Advisory SA-CONTRIB-2026-050 on June 17, 2026, the flaw carries a CVSS v3.1 score of 9.8 (Critical) and can lead to Remote Code Execution depending on PHP gadget chains available in the target environment.

CVE-2026-13238 is an Incorrect Authorization (Forceful Browsing) vulnerability in the Drupal Commerce Realex / Global Payments payment module, affecting all versions prior to 3.0.2. When the redirect payment method is configured, the module fails to sufficiently verify the authenticity of payment responses returned by Global Payments, allowing an unauthenticated remote attacker to forge a payment confirmation and complete orders without payment. NVD rates this vulnerability Critical with a CVSS v3.1 score of 9.1.

CVE-2026-57702 is a critical Blind SQL Injection vulnerability in the Amelia (ameliabooking) WordPress booking plugin, developed by Melograno Venture Studio, affecting all versions through 2.4.2. With a CVSS v3.1 score of 9.3 (Critical) and no authentication or user interaction required, any internet-facing WordPress site running an affected version of Amelia is immediately exposed to full database exfiltration by a remote, unauthenticated attacker. The vulnerability has been patched in version 2.4.3.

CVE-2026-57707 is a critical unauthenticated SQL injection vulnerability affecting the Simple Business Directory Pro WordPress plugin by QuantumCloud, in all versions up to and including 15.9.4. The flaw allows a remote, unauthenticated attacker to inject malicious SQL commands over the network and extract sensitive data from the underlying WordPress database. With a CVSS v3.1 base score of 9.3 (Critical), this vulnerability requires no authentication and no user interaction to exploit.

CVE-2026-57714 is a critical Blind SQL Injection vulnerability in the LatePoint appointment booking plugin for WordPress, affecting all versions through 5.6.3. Carrying a CVSS v3.1 base score of 9.3 (Critical), the flaw requires no authentication and no user interaction, allowing any remote attacker to systematically extract sensitive data from the underlying WordPress database — with scope impact extending beyond the plugin's own data. Sites running LatePoint on 100,000+ active installations worldwide are at risk and should upgrade immediately.

CVE-2026-22095 is a critical unauthenticated command injection vulnerability in the network diagnosis endpoint of the EVbee DC-80 DC fast charging station's built-in web server, running on port 8090. A remote, unauthenticated attacker can send a specially crafted HTTP request to this endpoint to execute arbitrary operating system commands on the device. Disclosed on July 10, 2026 as part of DIVD advisory DIVD-2026-00001, the flaw carries a CVSS 4.0 score of 9.3 (Critical) and affects all DC-80 firmware versions prior to V1.5.1.

CVE-2026-22096 is a critical missing-authentication vulnerability (CWE-306) in the EVbee DC-80 DC fast-charging station, affecting all firmware versions prior to V1.5.1. The device's built-in web server, running on TCP port 8090, implements no authentication mechanism, enabling any network-reachable attacker to retrieve sensitive configuration data — including stored credentials — and upload arbitrary files through multiple exposed endpoints. The vulnerability carries a CVSS 4.0 score of 9.3 (CRITICAL), assessed by the Dutch Institute for Vulnerability Disclosure (DIVD) under coordinated disclosure case DIVD-2026-00001.

CVE-2026-57739 is a critical Blind SQL Injection vulnerability (CWE-89) in the AcyMailing SMTP Newsletter plugin for WordPress, affecting all versions through 10.11.0. With a CVSS v3.1 base score of 9.3, the flaw can be triggered remotely by an unauthenticated attacker over the network with no user interaction required, enabling exfiltration of sensitive data from the underlying WordPress database.

CVE-2026-56271 is a critical authentication bypass vulnerability affecting Flowise, an open-source AI workflow builder, in all versions up to and including 3.0.13. The enterprise passport authentication middleware falls back to publicly known hardcoded JWT secrets and credential parameters when the corresponding environment variables are not configured, allowing any unauthenticated remote attacker to forge valid JWT tokens and fully impersonate any user, including administrators. The vulnerability is rated CVSS 9.8 (CRITICAL) under CVSS v3.1 and 9.3 under CVSS v4.0.