FreeRDP: FreeRDP: Remote code execution or denial of service via audio input integer overflow

A flaw was found in FreeRDP, an open-source implementation of the Remote Desktop Protocol RDP. This vulnerability, an integer overflow in the audio input redirection channel, allows a remote attacker to supply a malicious FramesPerPacket value. This can lead to a heap-based buffer overflow,...

CVE-2026-80237

EFence , developed by Thinking Software Technology , suffers from an Arbitrary File Upload vulnerability. An authenticated remote attacker (low privileges) can upload and execute a web shell on the server, leading to arbitrary code execution with high impact on confidentiality, integrity, and ava...

EUVD-2026-66342

CAYIN CMS-WS, CMS-SE, and SMP series products developed by CAYIN Technology have an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shells backdoors, thereby enabling arbitrary code execution on the server...

CVE-2026-80233 CAYIN Technology｜CAYIN CMS-WS/CMS-SE/SMP - Arbitrary File Upload

CAYIN CMS-WS, CMS-SE, and SMP series products developed by CAYIN Technology have an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shells backdoors, thereby enabling arbitrary code execution on the server...

WordPress Avada Theme <= 7.16 - Unauthenticated Remote Code Execution via Arbitrary File Write vulnerability

Unauthenticated Remote Code Execution via Arbitrary File Write vulnerability discovered by WordFence in WordPress Theme Avada versions = 7.16...

WordPress Fusion Builder plugin <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write vulnerability

Unauthenticated Remote Code Execution via Arbitrary File Write vulnerability discovered by WordFence in WordPress Plugin Fusion Builder versions = 3.16...

CVE-2026-38526

CVE-2026-38526 - Krayin CRM PHP Upload RCE Automatisierter Exploit für Krayin CRM ≤ 2.2.x. Dieses Skript nutzt eine Schwachstelle für uneingeschränkten Dateiupload im TinyMCE-Endpunkt /admin/tinymce/upload aus, umgeht die MIME-Typ-Validierung durch Vortäuschung von image/jpeg, lädt eine...

CVE-2012-2982

CVE-2012-2982 Exploit per CVE-2012-2982 CVE-2012-2982 è una vulnerabilità trovata in Webmin versione 1.580 e consente l'esecuzione di codice remoto...

CVE-2022-23642

PoC per Sourcegraph Gitserver 3.37.0 RCE CVE-2022-23642 Sourcegraph precedente alla 3.37.0 presenta una vulnerabilità di esecuzione di codice remota sul suo servizio gitserver. Ciò è dovuto alla mancanza di restrizioni sull'esecuzione della configurazione git, quindi "core.sshCommand" può essere...

CVE-2025-64446_CVE-2025-58034

FortiWeb Remote Code Execution RCE Exploit über die CVE-2025-64446 + CVE-2025-58034-Kette Beschreibung Dieses Skript verkettet zwei kritische Schwachstellen in Fortinet FortiWeb, um eine nicht authentifizierte Remote-Codeausführung mit Root-Rechten zu erreichen: 1. CVE-2025-64446 –...

CVE-2026-18431

The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two...

Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payload

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Tuesday warned of active exploitation efforts targeting a recently patched critical security flaw impacting Gitea. The vulnerability in question is CVE-2026-60004 CVSS score: 9.8, a case of remote code execution that allows an...

CVE-2026-58096

LcpDecodeConfig did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096 to crash ppp8 or potentially execute arbitra...

CVE-2026-18431 Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write

The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two...

CVE-2026-18431

The Avada WordPress theme (≤ 7.16) combined with the Fusion Builder plugin (≤ 3.16) is vulnerable to unauthenticated Remote Code Execution via a chain of six authorization and input validation weaknesses enabling arbitrary file write. An attacker can create and execute arbitrary PHP files, leadin...

EUVD-2026-66293

The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two...

CVE-2026-74851

The Pods WordPress plugin before 3.3.9.1 contains a flaw in how it compares a display callback against its list of blocked functions, enabling users with the author role or above to achieve remote code execution on the server. The vulnerability only affects sites using the restricted display-call...

CVE-2026-74851 Pods < 3.3.9.1 - Author+ RCE via Shortcode Display Callback

The Pods WordPress plugin before 3.3.9.1 does not correctly compare a display callback against its list of blocked functions, allowing users with the author role and above to execute arbitrary code on the server. Only sites using the restricted display-callback mode are affected, which is the...

CVE-2026-58096

FreeBSD ppp(8) contains an out-of-bounds write in LcpDecodeConfig(), which failed to validate the length of received multilink endpoint discriminator options against the minimum required by RFC 1717 . A malicious PPP peer can trigger the bug with undersized options, potentially crashing ppp(8) or...

Apache Kylin 3.0.1 - Command Injection Vulnerability

Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation. id: CVE-2020-1956 info: name: Apache Kylin 3.0.1 - Command Injecti...