CVE-2026-71294

Cotonti CMS Comments Plugin PHP Object Injection via Unrestricted unserialize() in Create/Edit Actions

Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/controllers/actions/CreateAction.php, a POST parameter obtained via (trim-only sanitization) is passed to with no restriction, reachable by any member with write access to comments (the default setting in plugins/comments/comments.setup.php).

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Cotonti

Products

Cotonti

CVE-2026-71293

Statamic CMS Unguarded Exposure of 2FA Recovery Codes via Antlers current_user Variable

Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the handle that returns the user's raw two-factor recovery codes with no access restriction.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Statamic

Products

Cms

CVE-2026-71292

Subrion CMS Admin Grid SQL Injection via Unwhitelisted ORDER BY sort Parameter

Subrion CMS's admin grid sorting helper, _gridGetSorting in includes/classes/ia.base.controller.admin.php, whitelists the (ASC/DESC) request parameter via in_array, but falls back to the raw, attacker-supplied GET parameter whenever the requested key is not present in the per-controller whitelist array: , which is then placed into %s with only backtick-quoting and no escaping.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Intelliants

Products

Subrion

CVE-2026-71291

Bolt CMS Server-Side Template Injection via Unsandboxed allow_twig Field Rendering

Bolt CMS renders content field values through Twig's full application-level Environment with no SandboxExtension registered anywhere in the codebase. In src/Entity/Field.php, getTwigValue calls shouldBeRenderedAsTwig, which gates rendering only on the field definition's allow_twig flag and a regex checking for , , or ; when true, the raw field value is compiled and rendered via with no sandboxing.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Bolt

Products

Core

CVE-2026-71289

NASA-AMMOS ANMS / JHUAPL dtnma-tools Unauthenticated Remote Command Execution via Exposed AMP Manager REST API

The NASA-AMMOS Asynchronous Network Management System (ANMS) reference implementation's default docker-compose.yml publishes the amp-manager service's REST API directly to the host network interface (port 8089, e.g. ":8089/tcp") with cap_add: NET_ADMIN, NET_RAW, SYS_NICE, bypassing the CAM (Configuration and Access Manager) gateway that is otherwise the system's sole authentication boundary.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Nasa-ammos

Products

Anms

CVE-2026-71288

Koha SQL Injection via order_by and {order}_ovalue Parameters in guided_reports.pl

Koha's guided report builder (reports/guided_reports.pl) reads the CGI parameter and, for each value, a dynamically-named parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation. Since ORDER BY columns cannot be bound via prepared-statement placeholders, this requires an explicit allowlist, which does not exist.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Koha-community

Products

Koha

CVE-2026-71286

ember-dynamic-render-template Client-Side Template Injection via Unsanitized templateString

The render-template component of ember-dynamic-render-template (addon/components/render-template.js) passes its property directly into Ember/Glimmer's compileTemplate (from @ember/template-compilation) with no sanitization, allow-listing, or validation of the input.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Miguelcobain

Products

Ember-dynamic-render-template

CVE-2026-71285

Uptime Kuma Stored XSS via Matomo Analytics Site ID on Public Status Pages

Uptime Kuma's Matomo analytics integration (server/analytics/matomo-analytics.js) injects the admin-configurable Matomo value as a bare, unquoted JavaScript expression inside a <script> block rendered on every public status page. A siteId value such as , once saved by an editor/admin, executes arbitrary JavaScript for every unauthenticated visitor of the public /status/<slug> page, enabling session-cookie theft and full page takeover.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Louislam

Products

Uptime-kuma

CVE-2026-71284

Fledge IoT Gateway Backup Restore OS Command Injection via Tar Member Filename

Fledge's backup-restore upload handler, upload_backup (python/fledge/services/core/api/backup_restore.py), takes the first extracted tar member's filename (tar_file_names[0]) and builds a shell command via string formatting. Because os.system invokes a shell and no quoting (shlex.quote, list-form subprocess) is applied, an admin uploading a crafted backup archive achieves arbitrary OS command execution.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Fledge-iot

Products

Fledge

CVE-2026-71283

Fledge IoT Gateway Backup Restore Tar Path Traversal

Fledge's backup-restore upload handler, upload_backup (python/fledge/services/core/api/backup_restore.py), calls tarfile.extractall(temp_path) on an admin-uploaded tar archive with no filter argument and no per-member path validation. Requires the admin role (@has_permission("admin")).

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Fledge-iot

Products

Fledge

CVE-2026-71282

ChirpStack SQLite Backend SQL Injection via Device Tag Key in ListDevices Filter

ChirpStack's SQLite-backend device tag filtering (chirpstack/src/storage/device.rs, in both get_count and list) interpolates the user-supplied tag KEY directly into a raw SQL fragment via Rust's format! macro , while only the tag VALUE is safely parameter-bound via Diesel's .bind.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Chirpstack

Products

Chirpstack

CVE-2026-71281

peft Unsafe Deserialization via torch.load() Without weights_only in LoRA-GA and CorDA Modules

Hugging Face peft's LoRA-GA and CorDA initialization modules (src/peft/tuners/lora/corda.py lines ~102 and ~163, and src/peft/tuners/lora/loraga.py line ~101) call torch.load on config-specified cache/covariance files without weights_only=True, bypassing peft's own safe-loading wrapper used elsewhere in the codebase.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Huggingface

Products

Peft

CVE-2026-71280

go-shiori Server-Side Request Forgery via Unrestricted Bookmark URL Fetch

go-shiori's DownloadBookmark (internal/core/download.go) fetches a caller-supplied bookmark URL using a plain http.Client with no custom DialContext or destination-IP validation (no IsLoopback, IsPrivate, IsUnspecified, or IsLinkLocalUnicast checks).

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Go-shiori

Products

Shiori

CVE-2026-71279

Zigbee2MQTT External JS Extension Path Traversal Leading to Remote Code Execution

Zigbee2MQTT's ExternalJSExtension.getFilePath (lib/extension/externalJS.ts) joins a parameter received via an MQTT message (topic zigbee2mqtt/bridge/request/extension/save) into the extensions base path using path.join(basePath, name) with no sanitization. The extension handler only validates that the name ends in .js/.mjs/.cjs, writes the file, and then dynamically imports it via Node.js import, achieving remote code execution.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Koenkk

Products

Zigbee2mqtt

CVE-2026-71278

rust-iot-platform Unauthenticated Remote Code Execution via Unsandboxed Calc-Rule Script Evaluation

rust-iot-platform allows creating a "calc rule" via POST /calc-rule/create (api/src/controller/calc_rule_router.rs) containing an arbitrary field. This route does not take the AuthToken request guard used elsewhere in the application, making it reachable without authentication.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Iot-ecology

Products

Rust-iot-platform

CVE-2026-71277

rust-iot-platform Authentication Bypass via Non-Validated Authorization Header

rust-iot-platform's AuthToken request-guard implementation (api/src/main.rs) only checks whether the Authorization HTTP header is present, and never validates its value against any session, token store, or signature. Any request carrying an arbitrary non-empty Authorization header (e.g. ) satisfies the guard, granting access to every endpoint protected only by this request guard.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Iot-ecology

Products

Rust-iot-platform

CVE-2026-71276

Magistrala (formerly Mainflux) IoT Platform SQL Injection via format Query Parameter

Magistrala (formerly Mainflux)'s message-readers API reads a value from the HTTP query string (readers/api/http/transport.go) with no validation and interpolates it directly into raw SQL queries via fmt.Sprintf in both the PostgreSQL reader (readers/postgres/messages.go: ) and the TimescaleDB reader (readers/timescale/messages.go, same pattern), enabling SQL injection by any authenticated user able to query channel messages.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Absmach

Products

Magistrala

CVE-2026-71274

OpenBK7231T Stored XSS via Unsanitized MQTT-Set Channel Labels

OpenBK7231T's CHANNEL_SetLabel (src/cmnds/cmd_channels.c) stores channel labels received via the MQTT SetChannelLabel command using strdup with no HTML sanitization. CHANNEL_GetLabel returns these labels unsanitized, and they are rendered via hprintf255 at 15+ locations in src/httpserver/http_fns.c with no HTML encoding.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Openshwprojects

Products

Openbk7231t App

CVE-2026-71273

OpenBK7231T CSRF in /cfg_wifi_set Leading to Implicit Web Password Disable and WiFi Hijack

OpenBK7231T's /cfg_wifi_set endpoint (src/httpserver/http_fns.c) accepts configuration changes via a plain GET request with no CSRF token. If the parameter is absent from the request, an else-branch silently clears the device's web admin password to an empty string.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Openshwprojects

Products

Openbk7231t App

CVE-2026-71272

Memos Webhook DNS Rebinding TOCTOU SSRF in safeDialContext()

Memos' webhook dispatch function safeDialContext (internal/webhook/webhook.go) resolves the target hostname via net.DefaultResolver.LookupHost and validates the resulting IPs against reserved ranges, but then dials net.JoinHostPort(host, port) using the original hostname rather than the already-validated IP address.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Usememos

Products

Memos