CVE-2026-21087

FUXA (version 1.3.2-2809) has an authorization bypass vulnerability in the /nodered functionality. A specially crafted HTTP request can lead to arbitrary code execution, and an attacker can trigger it with an unauthenticated HTTP request.

The Bot for Telegram on WooCommerce plugin (up to and including 1.3.0) is vulnerable to an authentication bypass leading to account takeover. The /wp-json/woo-telegram/v1/main/ REST endpoint lacks webhook signature verification, allowing an unauthenticated attacker to impersonate any WordPress user, including administrators, knowing only their login name.

In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create or edit scripts can execute arbitrary commands with the privileges of the openEQUELLA service account.

In D-Link DIR-505 1.10B02, the main function of /secmark1524.cgi in the Web Management CGI component allows manipulation of the accu/pass/code/hash/cmds arguments to cause a backdoor. The attack can be carried out remotely, and the exploit is publicly available.

In AVideo before 8.1.0, the live-streaming endpoint `view/videosListToLive.php` trusts attacker-supplied data in `webSiteRootURL` as session state, allowing an unauthenticated attacker to self-grant `isLogged` and `canStream`. Video-list paths are interpolated without escaping into `ffprobe` and `ffmpeg` commands executed via `exec`, enabling OS command injection. This is fixed in version 8.1.0.

In AVideo before 8.1.0, the unauthenticated installer endpoint `install/checkConfiguration.php` assembles `videos/configuration.php` by interpolating request parameters, including `webSiteRootURL`, into single-quoted PHP literals without escaping. An attacker can terminate a literal and inject PHP executed as the web-server user. Exploitation requires `videos/configuration.php` to be absent, and database parameters can point to an attacker-controlled server. This is fixed in version 8.1.0.

Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the `/skServer/ziplogs` endpoint. Attackers can extract the JWT `secretKey` from `security.json` in the ZIP, forge administrator tokens, and create persistent admin accounts. This is fixed in version 2.33.0.

Prior to version 0.1.4, FearlessCMS contains five debug/test PHP scripts under admin/ that perform privileged operations without authentication, CSRF protection, or adequate path validation. On PHP's built-in server (including the default Docker deployment), the /./admin/ path bypasses the login gate, enabling arbitrary .md writes, directory enumeration, stored/reflected XSS, and disk exhaustion.

In ai-gateway-payload-processing, an authenticated remote attacker can specify another tenant's model identifier in the request body or header. The service does not verify authorization before retrieving credentials from the shared store, so it injects the target tenant's API keys into the request.

In the Echo Go web framework from 4.0.0 until 4.16.1 and in 5.4.1, the Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later HTTP requests on the connection are sent directly to that upstream, bypassing Echo's router and route-specific middleware. This can bypass authentication or authorization enforced only by Echo routes.