Research

Cacti

Pre-authentication remote code execution chain, plus one unauthenticated information disclosure. Fixed in 1.2.31, a 33-fix security release.

Full technical write-up →

PUBLISHED 2026-06-24 (GitHub CNA) CVSS 9.8

CVE-2026-39955

Pre-authentication SQL injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.php

Fixed: Unfixed on develop as of report; the regression is absent from the 1.2.x line

Read the advisory →

PUBLISHED 2026-06-25 (GitHub CNA) CVSS 8.8

CVE-2026-40941

Package import signature validation bypass accepts self-signed packages

Fixed: Unfixed on develop as of report; absent from the 1.2.x line

Read the advisory →

RESERVED (GHSA-vp35-4h28-r883) CVSS 8.8

CVE-2026-39939

Path traversal in package import permits arbitrary file write

Fixed: see note

Read the advisory →

RESERVED CVSS 7.5

CVE-2026-94826

Unauthenticated REST API exposes internal network topology

Fixed: a8e1afba7393 (2026-08-21) on develop — ships in no tagged release; newest is release/1.2.31 (2026-06-15)

Read the advisory →

Appsmith Community Edition

Open-signup to super-admin takeover on self-hosted installs. Fixed across v2.0, v2.2 and v2.3.

Full technical write-up →

RESERVED (GHSA-qhfj-g87x-m39w) CVSS 8.1

CVE-2026-94831

Unauthenticated embedded Redis permits Spring session theft and super-admin takeover

Fixed: v2.0 (requirepass, commit 0d99237a1); explicitly v2.2 (commit 48ac053d5e)

Read the advisory →

RESERVED CVSS 6.5

CVE-2026-94830

Database datasource plugins bypass the WebClientUtils SSRF filter entirely

Fixed: v2.3 (commit 800cf99804, PR #41985)

Read the advisory →

RESERVED CVSS 4.9

CVE-2026-94829

/api/v1/admin/env discloses MongoDB root credentials in cleartext

Fixed: v2.0 closed the pre-auth route to super-admin

Read the advisory →

SubMgr

Seven issues, two of which chain into pre-authentication remote code execution on PHP below 8.1. All fixed in commit 658d46c8.

Full technical write-up →

RESERVED CVSS 8.1

CVE-2026-94832

Pre-authentication blind SQL injection via the email field

Fixed: commit 658d46c8 (inc_common.php:1600)

Read the advisory →

RESERVED CVSS 7.2

CVE-2026-94835

OS command injection in the database backup function

Fixed: commit 658d46c8 (inc_login.php:1302, escapeshellcmd)

Read the advisory →

RESERVED CVSS 7.5 unconditional

CVE-2026-94833

Unconstrained SQL injection in popup.php via extract($_REQUEST)

Fixed: commit 658d46c8 (popup.php:17-29)

Read the advisory →

RESERVED CVSS 8.8

CVE-2026-94838

Action attachments are stored with no file extension validation

Fixed: commit 658d46c8 (main_login.php:1349-1354)

Read the advisory →

RESERVED CVSS 4.9

CVE-2026-94834

Arbitrary file read in download.php via path traversal

Fixed: commit 658d46c8 (download.php:34-36)

Read the advisory →

RESERVED CVSS 6.5

CVE-2026-94836

SQL injection in the tag bulk-action handler

Fixed: commit 658d46c8 (inc_login.php:572)

Read the advisory →

RESERVED CVSS 7.5

CVE-2026-94837

TOCTOU in file upload writes the file before validating its extension

Fixed: commit 658d46c8 (inc_common.php:1567)

Read the advisory →

Need this kind of depth on your own systems?

The same methodology that found these bugs is what DKM Security brings to a client engagement.

Get In Touch