CVE-2026-66793 Governance-policy-addon-controller: governance-policy-addon-controller: arbitrary container image override via managedclusteraddon annotation enables rce on spoke

A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes. A user with permissions to annotate the namespaced ManagedClusterAddOn resource can override the governance-policy container image. This allows an attacker to run a controll...

CVE-2026-59940 Seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine...

EUVD-2026-60942

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine...

EUVD-2026-60822

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pendinglist while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and producing a...

CVE-2026-32444

Contributor Remote Code Execution RCE in Cwicly = 1.4.4 versions...

EUVD-2026-60774

Unauthenticated Remote Code Execution RCE in WP Compress 7.20.01 versions...

CVE-2026-32444 WordPress Cwicly plugin <= 1.4.4 - Remote Code Execution (RCE) vulnerability

Contributor Remote Code Execution RCE in Cwicly = 1.4.4 versions...

CVE-2026-32444

The WordPress Cwicly plugin (≤1.4.4) allows authenticated contributor-level users to trigger remote code execution via a network-accessible, low-complexity attack requiring no user interaction. CVSS 3.1 scores 9.9 (CRITICAL). Patchstack advisory: https://patchstack.com/database/wordpress/plugin/c...

CVE-2026-75827

Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the errorlog function through a data directive ...

CVE-2026-75827

Grav before 2.0.15 uses an incomplete denylist in Blueprint dynamic-data validation, allowing attackers with page-edit or blueprint-config access to invoke error_log via a data directive and append PHP payloads to web-accessible files, achieving remote code execution. CVSS 4.0 score is 9.3 (CRITI...

CVE-2026-75827 Grav before 2.0.15 Arbitrary File Write via error_log

Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the errorlog function through a data directive ...

CVE-2026-75827 Grav before 2.0.15 Arbitrary File Write via error_log

Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the errorlog function through a data directive ...

BIT-AIRFLOW-2026-67260 Apache Airflow: DAG-author remote code execution on the Scheduler via awaiting_input next_kwargs deserialization

Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new awaitinginput task state swept by the scheduler. That sweep deserializes the task instance's nextkwargs without an allow-list, so a Dag author — who controls that value through the task execution API — can cause an...

CVE-2026-70429 vulnerabilities

Vulnerabilities for packages: jenkins...

WordPress Royal Elementor Addons Plugin <= 1.3.78 - Arbitrary File Upload

Arbitrary File Upload vulnerability in WordPress Royal Elementor Addons Plugin. This could allow a malicious actor to upload any type of file to your website. This can include backdoors which are then executed to gain further access to your website. This vulnerability has been fixed in version...

Progress Kemp LoadMaster - Command Injection

Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution. id: CVE-2024-1212 info: name: Progress Kemp LoadMaster - Command Injection author: DhiyaneshDK severity: critical description: | Unauthenticated remote...

Gogs 0.5.5 - 0.12.2 - Remote Code Execution

Gogs 0.5.5 through 0.12.2 is susceptible to authenticated remote code execution via the git hooks functionality. There can be a privilege escalation if access to this feature is granted to a user who does not have administrative privileges. NOTE: Since this is mentioned in the documentation but n...

Apache Tomcat Path Equivalence - Remote Code Execution

Path Equivalence- 'file.Name' Internal Dot leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. id: CVE-2025-24813 info: name: Apache Tomcat Path Equivalence - Remote Code Execution...

Comodo Unified Threat Management Web Console - Remote Code Execution

Comodo Firewall & Central Manager UTM All Release before 2.7.0 & 1.5.0 are susceptible to a web shell based remote code execution vulnerability. id: CVE-2018-17431 info: name: Comodo Unified Threat Management Web Console - Remote Code Execution author: dwisiswant0 severity: critical description:...

Oracle WebLogic Server Administration Console - Remote Code Execution

The Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: Web Services versions 0.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0 contain an easily exploitable vulnerability that allows unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server. id:...