CVE-2026-91020

A flaw was found in WAVLINK WL-WN530HG4B (version M_V260724) in the port_forward function of /cgi-bin/wapi.cgi. Manipulation of the Name argument leads to OS command injection. The attack can be performed remotely and a public exploit is available.

A vulnerability was detected in WAVLINK WN579X3-D (version V250402) in the port_forward function of /cgi-bin/wapi.cgi. Manipulation of the Name argument results in OS command injection. The attack may be performed remotely and the exploit is publicly available.

A security vulnerability was detected in WAVLINK WL-WN579A3-A (version 2026-03-10-94f93d4) in the set_wzdgwMesh function of /cgi-bin/adm.cgi, within the Initial Setup Wizard component. Manipulation of the wlan_ssid argument leads to OS command injection. The attack can be carried out remotely and the exploit has been publicly disclosed.

A vulnerability was identified in D-Link DIR-505 1.10B02 in the save_upload_file/mp_upload_file function of /usr/bin/tftpd, which handles TFTP upload filenames. Manipulation of input leads to a stack-based buffer overflow. The attack can be carried out remotely, and a public exploit is available and might be used.

The JavaNativeMessageDecoder class in the Apache MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes without any class filter. An application that places it in front of an untrusted peer is exposed to gadget-chain remote code execution. The 3.0.0 branch is inactive and no fix will be released for it.

AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scripts to GroovyClassLoader for unauthenticated remote code execution.

Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats as an operator, then execute commands through Jpom's script features.

The SimpleForm plugin for WordPress (versions up to and including 3.10.2) is vulnerable to arbitrary file upload via the handle_upload function. Missing a server-side file key allowlist and pre-sanitization extension derivation allows a trailing-dot filename to bypass all extension and MIME validation, enabling unauthenticated attackers to upload executable files and achieve remote code execution. The only access control is a nonce printed into every public form's data-nonce attribute, trivially obtainable by any unauthenticated visitor.

The Acadlix LMS plugin for WordPress (versions up to and including 1.1.9) is vulnerable to arbitrary file deletion due to insufficient file path validation in the post_delete_assessment_file_by_id function. Authenticated attackers with subscriber-level access or higher can delete arbitrary files on the server, potentially leading to remote code execution when critical files such as wp-config.php are deleted. The route's permission callback only verifies a generic wp_rest nonce emitted in the public acadlixOptions JavaScript object on every frontend page, effectively reducing the authentication requirement to unauthenticated.

The Uncanny Toolkit for LearnDash plugin for WordPress (up to 3.8.2) is vulnerable to Authentication Bypass via the 'email' parameter in uo_login_action(). A parser-differential flaw allows skipping account verification by using a raw string for lookup and a sanitized string for login. This lets unauthenticated attackers log in to unverified or suspended accounts if they know the credentials.