Langflow AI - Unauthenticated Remote Code Execution

Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint.A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code. id: CVE-2025-3248 info: name: Langflow AI - Unauthenticated Remote Code Execution author: nvn172...

Roundcube Webmail - Remote Code Execution

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization. id: CVE-2025-49113 info: name: Roundcube Webmail - Remote...

ConnectWise ScreenConnect <= 23.9.7 - Path Traversal

ConnectWise ScreenConnect 23.9.7 and prior contain a path traversal caused by improper handling of user input, letting attackers execute remote code or access confidential data, exploit requires network access. id: CVE-2024-1708 info: name: ConnectWise ScreenConnect = 23.9.7 - Path Traversal...

DrayTek - Remote Code Execution

DrayTek Vigor2960 1.3.1Beta, Vigor3900 1.4.4Beta, and Vigor300B 1.3.3Beta, 1.4.2.1Beta, and 1.4.4Beta devices allow remote code execution as root without authentication via shell metacharacters to the cgi-bin/mainfunction.cgi URI. id: CVE-2020-8515 info: name: DrayTek - Remote Code Execution...

Apache OFBiz - Improper Authorization & Remote Code Execution

Improper Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met...

Apache OFBiz - Remote Code Execution

Apache OFBiz below 18.12.16 is vulnerable to unauthenticated remote code execution on Linux and Windows. An attacker with no valid credentials can exploit missing view authorization checks in the web application to execute arbitrary code on the server id: CVE-2024-45195 info: name: Apache OFBiz -...

Apache ActiveMQ - Remote Code Execution

Improper Input Validation, Improper Control of Generation of Code 'Code Injection' vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations o...

CraftCMS - Remote Code Execution

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity...

Zoho ManageEngine ADSelfService Plus v6113 - Unauthenticated Remote Command Execution

Zoho ManageEngine ADSelfService Plus version 6113 and prior are vulnerable to a REST API authentication bypass vulnerability that can lead to remote code execution. id: CVE-2021-40539 info: name: Zoho ManageEngine ADSelfService Plus v6113 - Unauthenticated Remote Command Execution author:...

cve-2025-32433_rce_exploit

Erlang/OTP SSH – CVE-2025-32433 Laboratorio TryHackMe ⚠️ Solo para uso educativo Este proyecto es estrictamente para aprendizaje y práctica en el laboratorio de la sala oficial de TryHackMe: https://tryhackme.com/room/erlangotpsshcve202532433 No uses esta herramienta contra sistemas que no poseas ...

CVE-2024-32002-PoC_Chinese

Resumen de la vulnerabilidad CVE-2024-32002 ⚠️¡Atención!: ¡No clone este repositorio! ⚠️ Descripción CVE-2024-32002 es una grave vulnerabilidad de seguridad descubierta en el software Git. Esta vulnerabilidad permite que un atacante remoto ejecute código arbitrario en sistemas afectados a través de...

EUVD-2026-72104

Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authentication is disabled the default, governance.authconfig.isenabled=false. The shared-object loader treats an http-prefixed path as a downlo...

CVE-2026-86218

N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14...

EUVD-2026-72041

N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14...

CVE-2026-86218 pre-authentication remote code execution

N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14...

CVE-2026-86218 pre-authentication remote code execution

N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14...

PT-2026-86470

Name of the Vulnerable Software and Affected Versions N-central versions prior to 2026.3.1.14 Description N-central contains a flaw that allows for pre-authentication remote code execution, enabling an attacker to execute arbitrary code on the system without requiring valid credentials...

VulnCheck KEV: CVE-2026-86218

N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14...

Exploit for Code Injection in Grafana

CVE-2026-27876: Grafana SQL Expressions Arbitrary File Write t...

Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials

JetBrains is urging Cadence users to revoke and rotate all credentials following a security incident last month in which unidentified threat actors exploited a recently disclosed critical vulnerability in TeamCity to breach its own environment. "Cadence users should immediately revoke or rotate a...