CVE-2026-48046

Streambert Vulnerable to Remote Code Execution (RCE) via Unvalidated Auto-Updater IPC Handler

Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 contain an unvalidated auto-updater URL vulnerability that allows a compromised renderer process to make the main process download and execute an arbitrary binary, resulting in remote code execution. Version 2.5.0 contains a patch.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Truelockmc

Products

Streambert

CVE-2025-41769

Unauthenticated Buffer Overflow in PROFINET Service

The device's PROFINET service is affected by a buffer overflow vulnerability that exists in the default configuration. An unauthenticated remote attacker could exploit this vulnerability to reboot the device or execute arbitrary code.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Phoenix Contact Phoenixcontact

Products

Axc F 1152 Axc F 1152 Firmware Axc F 1252 and 26 more

CVE-2025-31114

Fooocus webui vulnerable to Remote Code Execution

Fooocus is an image generating software. In versions 2.5.5 and prior, the Fooocus web UI is vulnerable to remote code execution due to the unsafe use of eval when processing metadata JSON. An attacker with access to the Fooocus web UI may be able to execute arbitrary code on the instance. As of time of publication, no known patched versions are available, but a suggested fix pull request is available.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Lllyasviel

Products

Fooocus

CVE-2025-71392

SurrealDB before 2.2.2 SurrealQL Injection via export

SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export command. An authenticated System User with OWNER or EDITOR roles can create tables or fields with malicious names containing SurrealQL. When a higher-privileged user subsequently imports the exported backup, the injected SurrealQL executes, enabling privilege escalation and root-level takeover of the SurrealDB instance. Applications that let users define custom tables or fields are also exposed to a universal second-order SurrealQL injection even when query parameters are sanitized.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Surrealdb

Products

Surrealdb

CVE-2026-73519

WolfStack < 25.9.2 Hard-coded Secret Authentication Bypass via X-WolfStack-Secret

WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a constant in src/auth/mod.rs, allowing remote unauthenticated attackers to bypass authentication by supplying this value in the X-WolfStack-Secret header to the require_auth() gate without any session, API key, or user account. Attackers can reach an affected node's management port to enumerate all Docker and LXC containers on the host and execute arbitrary commands as root inside any container via the POST /api/containers/{runtime}/{id}/exec endpoint.

CVSS 4.0 · 9.3 Critical EPSS 1.2% KEV · Not listed

Vendors

Wolfsoftwaresystemsltd

Products

Wolfstack

CVE-2026-8985

Unauthenticated Command Injection

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the /test endpoint exposed on TCP port 9002. An unauthenticated attacker can supply crafted input in the url parameter to execute arbitrary operating system commands.

CVSS 4.0 · 10 Critical EPSS 7.1% KEV · Not listed

Vendors

Autel

Products

Maxicharger Single Charger Maxicharger Single Charger Firmware

CVE-2026-8986

Command Injection via Malicious OCPP Server

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection when processing OCPP GetDiagnostics requests. A malicious or compromised OCPP server can supply a crafted diagnostics URL that results in arbitrary command execution on the charging station.

CVSS 4.0 · 9.5 Critical EPSS 3.3% KEV · Not listed

Vendors

Autel

Products

Maxicharger Single Charger Maxicharger Single Charger Firmware

CVE-2026-8984

Unauthenticated RCE

Autel Maxi Charger Single firmware through V1.03.51 allows unauthenticated remote code execution via the service listening on TCP port 9002. A crafted request to the /test endpoint can cause the device to download, extract, and execute attacker-controlled files with root privileges.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Autel

Products

Maxicharger Single Charger Maxicharger Single Charger Firmware

CVE-2026-8987

Authenticated Heap Overflow

Autel Maxi Charger Single firmware through V1.03.51 contains a heap-based buffer overflow in the set_ap_param command handled by the /localcfg endpoint. An authenticated attacker can supply oversized input, resulting in denial of service and potentially arbitrary code execution.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Autel

Products

Maxicharger Single Charger Maxicharger Single Charger Firmware

CVE-2026-67285

Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder < 6.8.0

Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder < 6.8.0 - An unauthenticated attacker can perform includes to arbitrary PHP files that are accessible by the system.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Joomshaper.net

Products

Sp Page Builder Extension For Joomla

CVE-2026-72742

DSPy 3.3.0b1 Local File Read via Image/Audio Output Field Parsing

DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters that allows attackers with influence over language model outputs to read arbitrary local files by injecting a filesystem path into the url field of a parsed Image or Audio typed output. The JSONAdapter and ChatAdapter parse untrusted language model completions through parse_value into TypeAdapter validation, which triggers encode_image or encode_audio to read and base64-encode any local file path via the os.path.isfile branch in image.py and audio.py, subsequently embedding the file contents into outgoing prompt messages sent to the attacker-controlled model endpoint.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Stanford Nlp

Products

Dspy

CVE-2026-73032

PapersGPT for Zotero 0.6.1 RCE via Unsanitized LLM Response eval()

PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that allows attackers to execute arbitrary JavaScript by returning malicious code from an LLM endpoint that is passed unsanitized to window.eval() in views.ts. Attackers can exploit this through prompt injection in PDFs, MITM interception of API requests, or a malicious custom LLM endpoint to execute arbitrary code in Zotero's chrome-privileged context, enabling file read/write, process execution, and access to all Zotero data.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Papersgpt

Products

Papersgpt-for-zotero

CVE-2026-68067

Mira Hormone Monitor, Mira Android App Weak Authentication

The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for the account matching the supplied email address. An attacker could use an email address to control cloud accounts and access hormone record information and account settings.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Quanovate Tech

Products

Mira Android App Mira Firmware

CVE-2026-67568

Mira Hormone Monitor, Mira Android App Use of Hard-coded Credentials

The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to reproductive health profiles from internet connected hosts, which could result in forgery, deletion, or destruction of health information.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Quanovate Tech

Products

Mira Android App Mira Firmware

CVE-2026-73407

Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak (bypass of CVE-2026-48152))

Budibase is an open-source low-code platform. Prior to 3.40.1, RestIntegration._req in packages/server/src/integrations/rest.ts attached credentials from getAuthHeaders and defaultHeaders without requiring the final request destination to match the datasource origin. An unauthenticated caller of a PUBLIC POST /api/v2/queries/:queryId query could supply an absolute or parameterized path to an attacker-controlled host and receive the stored bearer, basic, or static-header credentials. This issue is fixed in version 3.40.1.

CVSS 4.0 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

Budibase

Products

Budibase

CVE-2026-19425

Win Men Intermational｜Travel Agency Management System - SQL Injection

Travel Agency Management System developed by Win Men Intermational has a SQL Injection vulnerability. Unauthenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database contents.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Win Men Intermational

Products

Travel Agency Management System

CVE-2025-15681

Insufficient Webserver Authentication

TBEA TLogger V2.1.0.0B0.0.0.0 contains an authentication bypass in its web server. After a user has previously authenticated to the device, an unauthenticated attacker can directly access protected functionality through the /index.asp endpoint without providing valid credentials. This allows the attacker to access functionality intended for authenticated users and may expose or modify device configuration and data. Logging out from the bypassed state can additionally cause the web server to crash.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Tbea

Products

Tbea Tlogger

CVE-2025-13294

Unauthenticated SQL Injection

An unauthenticated SQL injection vulnerability exists in the web server of TBEA TLogger V2.1.0.0B0.0.0.0. Multiple HTTP endpoints incorporate attacker-controlled parameters directly into SQLite queries without sufficient validation or parameterization. A remote unauthenticated attacker can exploit these endpoints to read, modify, or delete data stored in the device's CCU.db database.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Tbea

Products

Tbea Tlogger

CVE-2025-13293

Backdoor / default root credentials

A hard-coded or default root account credential in TBEA TLogger V2.1.0.0B0.0.0.0 allows an unauthenticated remote attacker to obtain root-level access to the device via the exposed SSH service. The root password can be recovered from the password hash stored in /etc/shadow and used to authenticate to the SSH service. Successful exploitation provides full administrative control of the affected device.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Tbea

Products

Tbea Tlogger

CVE-2026-67282

Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.6.8

Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.6.8 - An unauthenticated attacker could execute arbitrary code by using the frontend listfilter model.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Fabrikar.com

Products

Fabrik Extension For Joomla