EUVD-2026-53912

Shop manager Remote Code Execution RCE in CTX Feed = 6.6.42 versions...

CVE-2026-65553 WordPress Spider Analyser – WordPress搜索引擎蜘蛛分析插件 plugin <= 2.1.3 - Remote Code Execution (RCE) vulnerability

Unauthenticated Remote Code Execution RCE in Spider Analyser WordPress搜索引擎蜘蛛分析插件 = 2.1.3 versions...

EUVD-2026-53981

Unauthenticated Remote Code Execution RCE in Spider Analyser WordPress搜索引擎蜘蛛分析插件 = 2.1.3 versions...

CVE-2026-65553

Unauthenticated Remote Code Execution in WordPress Spider Analyser plugin (

EUVD-2026-53978

Contributor Remote Code Execution RCE in Betheme = 28.4.2 versions...

CVE-2026-65548

Contributor Remote Code Execution RCE in Betheme = 28.4.2 versions...

CVE-2026-65548 WordPress Betheme theme <= 28.4.2 - Remote Code Execution (RCE) vulnerability

Contributor Remote Code Execution RCE in Betheme = 28.4.2 versions...

CVE-2026-65548

The connected sources confirm a Remote Code Execution (RCE) vulnerability affecting WordPress Betheme theme versions

CVE-2026-53975

OpenChamber 1.11.7 is affected by an unauthenticated RCE via POST /api/fs/exec. The endpoint passes commands verbatim to Node.js spawn() without any allowlist or argument validation, enabling remote execution of arbitrary OS commands. The authentication middleware becomes a no-op when UI_PASSWORD...

CVE-2026-66373

A flaw was found in Redis. An authenticated attacker, in an unusual configuration where they can execute the RESTORE command, could exploit a double free vulnerability. This occurs when a specially crafted RESTORE payload references the same NACK pending entry by multiple consumers, and both...

Azure Service Bus Remote Code Execution Vulnerability

Deserialization of untrusted data in Azure Service Bus allows an authorized attacker to execute code over a network...

Azure Confidential Ledger Remote Code Execution Vulnerability

Exposed dangerous method or function in Azure Confidential Ledger allows an authorized attacker to execute code over a network...

Exploit for Improper Input Validation in Drupal

CVE-2018-7600 Drupalgeddon2 — Red Team Project ITSOLERA...

MAL-2026-13398 Malicious code in @xiaohhhh1/canvas-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a34add291ef7584aec7041449cb2e80d36ae98f93c2725e1aa018707e3334119 On bin start, @xiaohhhh1/canvas-agent opens an outbound WebSocket to the hardcoded relay wss://canvas.xiaohhhh1.com/api/agent-relay and treats inboun...

MAL-2026-13397 Malicious code in @vanexalabs-ai/vanexa-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab5de2359eef117d1f491dc2c8628e56d866435912bd6f8e55a10eee8e7a9a6c The package implements a daemon that pairs with a remote peer phone over WebRTC, using https://vanexa-agent-relay.workers.dev and...

Malicious code in @vanexalabs-ai/vanexa-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab5de2359eef117d1f491dc2c8628e56d866435912bd6f8e55a10eee8e7a9a6c The package implements a daemon that pairs with a remote peer phone over WebRTC, using https://vanexa-agent-relay.workers.dev and...

CVE-2026-67305

The FreeRDP Windows client contains a heap buffer overflow vulnerability. If a user pastes maliciously crafted, oversized clipboard data from an untrusted RDP server, it triggers memory corruption that may result in remote code execution...

libXfont2: computeProps Property Buffer Heap Buffer Overflow

A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2 ComputeScaledProperties before libXfont2 before 2.0.8 could be used by attackers using authenticated X clients to execute code within the X server...

CVE-2026-66909

Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or,...

EUVD-2026-53854

Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or,...