CVE-2026-0606

An unauthenticated Remote Code Execution vulnerability was found in REDCap 13.3.0 and higher in the survey passthrough routing and Data Import processing logic. An attacker can manipulate HTTP requests to access an unintended controller route from a public survey context and supply a crafted file-path/stream parameter during import handling. Exploitation requires knowledge of a valid public survey hash.

A stack-based buffer overflow vulnerability was found in Comfast CF-N1-S 2.6.0.1 in the get_css_path_from_uri function of /cgi-bin/mbox-config in the Web Management Interface. The attack can be initiated remotely, and the exploit has been publicly disclosed and may be used.

Use-after-free vulnerability in Suricata before 8.0.7 occurs in the Http2ThreadMultiBuf mechanism when a transaction is inspected by rules using http.response_header with and without a transform.

In Suricata before 8.0.7, a type confusion in DoH2 can cause an invalid free because cleanup code for HTTP2 state runs even though the actual state is HTTP1 (when there is a DoH2 request with an HTTP1 to HTTP2 upgrade). This requires app-layer.protocols.doh2 to be enabled, which is default in 8.x versions.

Vulnerability in D-Link R95 (BE9500_1.00.16) affects the system function in /bin/ssi of the DHMAPI component. Manipulation of the NTPServer argument results in OS command injection. The attack can be executed remotely, and the exploit is public.

OpenPanel js-runtime through commit bad75bdd contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member access to constructor chains. Attackers with project write access can create webhook templates using computed property notation to access Function constructor and execute arbitrary code in the worker process.

DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM. These attributes are passed to require without checking that the value names a module, allowing loading and executing code from any file.

A vulnerability has been identified in the Totolink A3002MU router (version Hh-B20211125.1046) in the formWsc function of the /boafrm/formWsc file. Manipulation of the localPin argument leads to command injection. The attack can be launched remotely, and a public exploit is already available.

The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation checks on one of its REST routes, allowing unauthenticated users to update arbitrary WordPress options with arbitrary values, which could lead to privilege escalation and a full site takeover. The same route also allows unauthenticated users to store arbitrary web scripts which are then executed on every page of the site's front end, as well as to move arbitrary posts to the trash.

A vulnerability has been discovered in the Totolink A3002MU router (version Hh-B20211125.1046) in the formWlWds function of the /boafrm/formWlWds file. Manipulation of the submit-url argument results in a buffer overflow. The attack can be launched remotely, and a public exploit has already been released.