IONIX THREAT CENTER

CVE-2026-85109 is a buffer overflow vulnerability in the formLogin function of the Boa web server component in Tenda HG10 firmware version 300001138. Remote, unauthenticated attackers can send a crafted Username parameter to /boaform/formLogin to overflow a fixed-size buffer, with confirmed denial-of-service impact and potential for remote code execution. The exploit has been publicly disclosed.

CVE-2026-85181 is a critical authentication bypass vulnerability in Dianping's CAT (a Java-based application performance monitoring platform), rated 9.8 (CVSS v3.1). The flaw allows an unauthenticated network attacker to forge a valid administrator session cookie entirely offline, because CAT's session integrity check relies solely on Java's unkeyed String.hashCode() function combined with a client-controlled X-Forwarded-For header used for IP validation. Successful exploitation grants full administrative access to CAT's configuration console with no prior authentication or user interaction required.

CVE-2026-85216 is a critical authentication bypass vulnerability in MISP (Malware Information Sharing Platform), affecting the platform's LDAP and LinOTP authentication plugins in versions up to and including 2.5.45. The flaw allows an attacker who knows a valid directory user's email address to authenticate as that user by submitting an empty password, potentially gaining administrative access. The vulnerability carries a CVSS score of 9.5 (Critical).

CVE-2026-78080 is an unauthenticated SQL injection vulnerability in the JooDatabase Lite extension for Joomla, caused by improper neutralization of special elements (CWE-89) in the cid parameter. The flaw allows any remote, unauthenticated attacker to inject arbitrary SQL into backend database queries. It carries a CRITICAL severity rating of 9.3.

CVE-2026-85154 is an authentication/privilege management flaw in WWBN AVideo, an open-source video platform. The video_id_hash value, intended only as a per-video authorization token, functions as a non-expiring, non-revocable bearer credential that grants a full administrator-level logged-in session as the video's owner. This vulnerability is rated CRITICAL, with a CVSS v3.1 score of 9.8 and a CVSS v4.0 score of 9.3.

CVE-2026-73475 is an incorrect authorization (CWE-863) vulnerability in the Commerce PayPal module for Drupal Commerce, rated Critical with a CVSS v3.1 base score of 9.1. The module fails to sufficiently validate the transaction result returned by PayPal in certain flows, allowing an unauthenticated attacker to force-browse to order-completion logic and mark a transaction as paid without ever completing payment. The issue is scoped to sites using the Payflow Link payment gateway.

CVE-2026-19117 is a critical authentication bypass vulnerability (CWE-290, spoofing) in Delinea Secret Server on-premises deployments. Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and subsequently authenticate as that user, gaining full account takeover without prior credentials or user interaction. The issue carries a CVSS v3.1 base score of 9.8 (Critical) and affects on-prem installations only — cloud/SaaS deployments are not impacted.

CVE-2026-51705 is a critical improper access control vulnerability affecting the TOTOLINK T6 wireless router running firmware version 4.1.5cu.748_B20211015. The flaw resides in the setWiFiMeshName function exposed via the device's /cgi-bin/cstecgi.cgi endpoint, and allows a completely unauthenticated, remote attacker to rename mesh network entries on the device. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical), reflecting its network attack vector, low complexity, and lack of any authentication or user interaction requirement.

CVE-2026-83548 is a critical, pre-authentication Server-Side Request Forgery (SSRF) vulnerability in the Work Place interface of SonicWall SMA1000 secure remote access appliances. An unauthenticated remote attacker can abuse the appliance as an unintended proxy to reach sensitive internal functionality and perform unauthorized operations. SonicWall rates the flaw 10.0 (Critical) and has confirmed active exploitation in the wild.

CVE-2026-51733 is an incorrect access control vulnerability in the FirmwareUpgrade function of the TOTOLINK T6 wireless router, firmware 4.1.5cu.748_B20211015. It allows a remote, unauthenticated attacker to send a crafted HTTP POST request to the device's management CGI interface and remove Wi-Fi schedule entries without any credentials. The flaw carries a CVSS v3.1 base score of 9.8 (Critical).

CVE-2026-51723 is an incorrect access control vulnerability in the UploadCustomModule function of TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015. The flaw allows an unauthenticated attacker to install a custom CGI module on the device by sending a crafted POST request to /cgi-bin/cstecgi.cgi. It carries a CVSS v3.1 base score of 9.1 (Critical).

CVE-2026-51728 is a critical improper access control vulnerability (CWE-284) in the UploadFirmwareFile function of TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015. The flaw allows an unauthenticated, remote attacker to upload an arbitrary crafted firmware image to the device via the CGI management interface. Given a CVSS v3.1 base score of 9.8 (Critical), successful exploitation can fully compromise device confidentiality, integrity, and availability.

CVE-2026-53611 is a critical OS command injection vulnerability in Looking Glass, a network diagnostic platform (developed by AS203038) that exposes ping, traceroute, and BGP lookup functionality via a gRPC API and web UI. The flaw resides in the BGP AS-path input validation logic and allows an unauthenticated remote attacker to execute arbitrary operating system commands on the underlying host. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical).

CVE-2026-51684 is a critical improper access control vulnerability (CWE-284) in the setStorageCfg function of TOTOLINK T6 router firmware version 4.1.5cu.748_B20211015. The flaw allows unauthenticated remote attackers to alter the router's storage-related service state by sending a crafted POST request to the device's CGI endpoint. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical).

CVE-2026-51690 is an improper access control vulnerability in the setWanCfg function of TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015. It allows an unauthenticated, remote attacker to send a crafted POST request to the device's CGI handler and alter the router's upstream (WAN) provisioning and connectivity settings. The flaw carries a CVSS v3.1 base score of 9.1 (Critical).

CVE-2026-51934 is a critical buffer overflow vulnerability affecting the Tenda A18 wireless router running firmware version 15.13.07.09. The flaw resides in the fromSetCmdlineRun function, which is reachable via an HTTP request handler and does not validate the size of attacker-supplied input before copying it into a fixed-size buffer. Because the vulnerability requires no authentication or user interaction and is exploitable over the network, it carries a CVSS v3.1 base score of 9.8 (Critical).

CVE-2026-51738 is an improper access control vulnerability (CWE-284) in the LoadDefSettings function of TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015. An unauthenticated remote attacker can send a crafted POST request to the device's CGI interface to force a factory reset and reboot of the router. The flaw carries a CVSS v3.1 base score of 9.8 (Critical).

CVE-2026-51689 is an incorrect access control vulnerability (CWE-284) in the setUpgradeFW function of the TOTOLINK T6 router firmware. It allows an unauthenticated, remote attacker to send a crafted POST request to the device's CGI endpoint and trigger changes to the firmware-upgrade workflow. The flaw carries a CVSS v3.1 base score of 9.1 (Critical).

CVE-2026-52111 is a critical improper access control vulnerability in fast-note-sync-service, a self-hosted note synchronization and REST API backend, affecting versions 2.13.7 and earlier. The flaw allows a remote, unauthenticated attacker to escalate privileges and ultimately impersonate any user, including administrators, by abusing an admin configuration endpoint that exposes JWT signing material. The issue has a CVSS v3.1 base score of 9.8 (Critical).

CVE-2026-51687 is an improper access control vulnerability (CWE-284) in TOTOLINK T6 router firmware 4.1.5cu.748_B20211015. The setWiFiEasyGuestCf function in the router's /cgi-bin/cstecgi.cgi endpoint fails to enforce authentication, allowing unauthenticated network attackers to create or weaken the device's guest wireless network configuration. The flaw carries a Critical CVSS v3.1 base score of 9.1.

CVE-2026-51692 is an incorrect access control vulnerability in the setWiFiGuestCfg function of TOTOLINK T6 router firmware version 4.1.5cu.748_B20211015. The flaw allows unauthenticated remote attackers to establish or weaken guest wireless network access via a crafted POST request, and it carries a CRITICAL severity rating.

CVE-2026-51691 is an incorrect access control vulnerability (CWE-284) in the setUploadSetting function of TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015. The flaw allows a remote, unauthenticated attacker to manipulate the device's upload or firmware flash workflow by sending a crafted POST request to the device's management CGI interface. It carries a CVSS v3.1 base score of 9.8 (Critical).

CVE-2025-9314 is a critical unauthenticated arbitrary file upload vulnerability (CWE-434) in the Developer Tools WordPress plugin, versions through 1.1.3. The flaw resides in the plugin's bundled SWFUpload component and allows any unauthenticated attacker to upload arbitrary files to the server, which can lead to full site compromise. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical).

CVE-2026-4357 is a critical unrestricted file upload vulnerability (CWE-434) in the Embed HTML5 Game WordPress plugin, affecting all versions through 1.3. The plugin fails to enforce access control or file-type restrictions on its upload functionality, allowing unauthenticated attackers to upload arbitrary PHP files. Successful exploitation can lead to full remote code execution and complete compromise of the affected WordPress site.

CVE-2026-81294 is a critical unauthenticated privilege escalation vulnerability affecting the Authorizer plugin for WordPress, caused by incorrect privilege assignment (CWE-266). The flaw allows an unauthenticated attacker to escalate privileges on the affected site over the network, with no user interaction required. It carries a CVSS v3.1 base score of 9.8 (Critical) and impacts confidentiality, integrity, and availability.