CVE-2026-1475

Out-of-band SQL injection in Quatuor Performance Evaluation

An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Programación. Exploiting this vulnerability in the parameter ‘Id_usuario' in ‘/evaluacion_acciones_evalua.aspx’, could allow an attacker to extract sensitive information from the database through external channels, without the affected application returning the data directly, compromising the confidentiality of the stored information.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Quatuor

Products

Evaluacion De Desempeno

CVE-2026-1481

Out-of-band SQL injection in Quatuor Performance Evaluation

An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Programación. Exploiting this vulnerability in the parameter 'Id_usuario' in '/evaluacion_objetivos_anyo_sig_ver_auto.aspx', could allow an attacker to extract sensitive information from the database through external channels, without the affected application returning the data directly, compromising the confidentiality of the stored information.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Quatuor

Products

Evaluacion De Desempeno

CVE-2026-24685

OpenProject has Argument Injection on Repository module that allows Arbitrary File Write

OpenProject is an open-source, web-based project management software. Versions prior to 16.6.6 and 17.0.2 have an arbitrary file write vulnerability in OpenProject’s repository diff download endpoint (`/projects/:project_id/repository/diff.diff`) when rendering a single revision via git show. By supplying a specially crafted rev value (for example, `rev=--output=/tmp/poc.txt)`, an attacker can inject git show command-line options. When OpenProject executes the SCM command, Git interprets the attacker-controlled rev as an option and writes the output to an attacker-chosen path. As a result, any user with the `:browse_repository` permission on the project can create or overwrite arbitrary files that the OpenProject process user is permitted to write. The written contents consist of git show output (commit metadata and patch), but overwriting application or configuration files still leads to data loss and denial of service, impacting integrity and availability. The issue has been fixed in OpenProject 17.0.2 and 16.6.6.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Openproject

Products

Openproject

CVE-2026-1453

Missing Authentication for Critical Function in KiloView Encoder Series

A missing authentication for critical function vulnerability in KiloView Encoder Series could allow an unauthenticated attacker to create or delete administrator accounts. This vulnerability can grant the attacker full administrative control over the product.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Kiloview

Products

Encoder Series

CVE-2026-1803

Ziroom ZHOME A0101 Dropbear SSH Service default credentials

A weakness has been identified in Ziroom ZHOME A0101 1.0.1.0. Impacted is an unknown function of the component Dropbear SSH Service. This manipulation causes use of default credentials. Remote exploitation of the attack is possible. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Ziroom

Products

Zhome A0101

CVE-2026-1633

Synectix LAN 232 TRIO Missing Authentication for Critical Function

The Synectix LAN 232 TRIO 3-Port serial to ethernet adapter exposes its web management interface without requiring authentication, allowing unauthenticated users to modify critical device settings or factory reset the device.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Synectix

Products

Lan 232 Trio

CVE-2026-25049

n8n Has an Expression Escape Vulnerability Leading to RCE

n8n is an open source workflow automation platform. Prior to versions 1.123.17 and 2.5.2, an authenticated user with permission to create or modify workflows could abuse crafted expressions in workflow parameters to trigger unintended system command execution on the host running n8n. This issue has been patched in versions 1.123.17 and 2.5.2.

CVSS 4.0 · 9.4 Critical EPSS 1.6% KEV · Not listed

Vendors

N8n

Products

N8n

CVE-2026-25056

n8n Arbitrary File Write leading to RCE in n8n Merge Node

n8n is an open source workflow automation platform. Prior to versions 1.118.0 and 2.4.0, a vulnerability in the Merge node's SQL Query mode allowed authenticated users with permission to create or modify workflows to write arbitrary files to the n8n server's filesystem potentially leading to remote code execution. This issue has been patched in versions 1.118.0 and 2.4.0.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

N8n

Products

N8n

CVE-2026-21893

n8n Vulnerable to Command Injection in Community Package Installation

n8n is an open source workflow automation platform. From version 0.187.0 to before 1.120.3, a command injection vulnerability was identified in n8n’s community package installation functionality. The issue allowed authenticated users with administrative permissions to execute arbitrary system commands on the n8n host under specific conditions. This issue has been patched in version 1.120.3.

CVSS 4.0 · 9.4 Critical EPSS 1.5% KEV · Not listed

Vendors

N8n

Products

N8n

CVE-2026-25753

PlaciPy has a Hard-Coded Default Password for All Student Accounts (Account Takeover)

PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the application uses a hard-coded, static default password for all newly created student accounts. This results in mass account takeover, allowing any attacker to log in as any student once the password is known.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Praskla-technology Prasklatechnology

Products

Assessment-placipy Placipy

CVE-2026-25752

FUXA Unauthenticated Remote Arbitrary Device Tag Write

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An authorization bypass vulnerability in FUXA allows an unauthenticated, remote attacker to modify device tags via WebSockets. Exploitation allows an unauthenticated, remote attacker to bypass role-based access controls and overwrite arbitrary device tags or disable communication drivers, exposing connected ICS/SCADA environments to follow-on actions. This may allow an attacker to manipulate physical processes and disconnected devices from the HMI. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Frangoteam

Products

Fuxa

CVE-2026-25938

FUXA Unauthenticated Remote Code Execution in Node-RED Integration

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through 1.2.10, an authentication bypass vulnerability in FUXA allows an unauthenticated, remote attacker to execute arbitrary code on the server when the Node-RED plugin is enabled. This has been patched in FUXA version 1.2.11.

CVSS 4.0 · 9.5 Critical EPSS 1.1% KEV · Not listed

Vendors

Frangoteam

Products

Fuxa

CVE-2026-25939

FUXA Unauthenticated Remote Arbitrary Scheduler Write

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through version 1.2.10, an authorization bypass vulnerability in the FUXA allows an unauthenticated, remote attacker to create and modify arbitrary schedulers, exposing connected ICS/SCADA environments to follow-on actions. This has been patched in FUXA version 1.2.11.

CVSS 4.0 · 9.3 Critical EPSS 24.3% KEV · Not listed

Vendors

Frangoteam

Products

Fuxa

CVE-2026-2095

Flowring｜Agentflow - Authentication Bypass

Agentflow developed by Flowring has an Authentication Bypass vulnerability, allowing unauthenticated remote attackers to exploit a specific functionality to obtain arbitrary user authentication token and log into the system as any user.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Flowring

Products

Agentflow

CVE-2026-25084

ZLAN Information Technology ZLAN5143D Missing Authentication for Critical Function

Authentication for ZLAN5143D can be bypassed by directly accessing internal URLs.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Zlan Information Technology Co.

Products

Zlan5143d

CVE-2026-24789

ZLAN Information Technology ZLAN5143D Missing Authentication for Critical Function

An unprotected API endpoint allows an attacker to remotely change the device password without providing authentication.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Zlan Information Technology Co.

Products

Zlan5143d

CVE-2026-26217

Crawl4AI < 0.8.0 Docker API Local File Inclusion via file URL Handling

Crawl4AI versions prior to 0.8.0 contain a local file inclusion vulnerability in the Docker API deployment. The /execute_js, /screenshot, /pdf, and /html endpoints accept file:// URLs, allowing unauthenticated remote attackers to read arbitrary files from the server filesystem. An attacker can access sensitive files such as /etc/passwd, /etc/shadow, application configuration files, and environment variables via /proc/self/environ, potentially exposing credentials, API keys, and internal application structure.

CVSS 4.0 · 9.2 Critical EPSS 2.1% KEV · Not listed

Vendors

Kidocode Unclecode

Products

Crawl4ai Crawl4ai

CVE-2026-26020

AutoGPT Affected by Remote Code Execution via Dynamic Module Import in Block Loading (__import__)

AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to 0.6.48, an authenticated user could achieve Remote Code Execution (RCE) on the backend server by embedding a disabled block inside a graph. The BlockInstallationBlock — a development tool capable of writing and importing arbitrary Python code — was marked disabled=True, but graph validation did not enforce this flag. This allowed any authenticated user to bypass the restriction by including the block as a node in a graph, rather than calling the block's execution endpoint directly (which did enforce the flag). This vulnerability is fixed in 0.6.48.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Agpt Significant-gravitas

Products

Autogpt Platform Autogpt

CVE-2026-23647

Glory RBG-100 Recycler System Hard-coded OS Credentials

Glory RBG-100 recycler systems using the ISPK-08 software component contain hard-coded operating system credentials that allow remote authentication to the underlying Linux system. Multiple local user accounts, including accounts with administrative privileges, were found to have fixed, embedded passwords. An attacker with network access to exposed services such as SSH may authenticate using these credentials and gain unauthorized access to the system. Successful exploitation allows remote access with elevated privileges and may result in full system compromise.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Glory Global Solutions

Products

Rbg-100

CVE-2026-27180

MajorDoMo Supply Chain Remote Code Execution via Update URL Poisoning

MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated remote code execution through supply chain compromise via update URL poisoning. The saverestore module exposes its admin() method through the /objects/?module=saverestore endpoint without authentication because it uses gr('mode') (which reads directly from $_REQUEST) instead of the framework's $this->mode. An attacker can poison the system update URL via the auto_update_settings mode handler, then trigger the force_update handler to initiate the update chain. The autoUpdateSystem() method fetches an Atom feed from the attacker-controlled URL with trivial validation, downloads a tarball via curl with TLS verification disabled (CURLOPT_SSL_VERIFYPEER set to FALSE), extracts it using exec('tar xzvf ...'), and copies all extracted files to the document root using copyTree(). This allows an attacker to deploy arbitrary PHP files, including webshells, to the webroot with two GET requests.

CVSS 4.0 · 9.3 Critical EPSS 1.2% KEV · Not listed

Vendors

Mjdm Sergejey

Products

Majordomo Majordomo