CVE-2026-86730 Craft CMS 5.0.0-RC1 before 5.10.12 Behavior Injection RCE

Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated control-panel users to inject Yii2 behavior attachments and event handlers. Attackers can post field-layout tab elements as JSON strings to bypass cleanse validation, then trigger...

CVE-2026-86730

Craft CMS versions from 5.0.0-RC1 before 5.10.12 are vulnerable to Remote Code Execution (RCE) due to improper cleansing of string-typed field-layout elements. An authenticated control-panel user can post field-layout tab elements as JSON strings to bypass cleanse validation, injecting Yii2 behav...

CVE-2026-86730 Craft CMS 5.0.0-RC1 before 5.10.12 Behavior Injection RCE

Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated control-panel users to inject Yii2 behavior attachments and event handlers. Attackers can post field-layout tab elements as JSON strings to bypass cleanse validation, then trigger...

BUK_TS_KILLER

BUKTSKILLER BUK-TS Exploit RCE Authentification Bypass - CVE-2026-12183: 1. write any password 2. intercept response 3. write "userid=" 4. successfully bypassed Public Exploit for BDU:2025-13914 and CVE-2026-3843...

CVE-2026-12647

A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server...

CVE-2026-12647

A Missing Authorization vulnerability in Ivanti Neurons for ITSM before version 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server. The flaw enables privilege escalation beyond the attacker's initial credentials, reflected in a CVSS 3.1 score of 9.9 (Critical) w...

CVE-2026-12646

Ivanti Neurons for ITSM before version 2026.2 is affected by a Missing Authorization vulnerability that allows a remote authenticated attacker to execute arbitrary code on the server . The CVSS 3.1 base score is 9.9 (CRITICAL) , with a Changed Scope and High impact to confidentiality, integrity, ...

CVE-2026-12645

CVE-2026-12645 is a Missing Authorization vulnerability in Ivanti Neurons for ITSM affecting versions before 2026.2 . A remote authenticated attacker can leverage this flaw to execute arbitrary code on the server, with the scope changed and high impact on confidentiality, integrity, and availabil...

CVE-2026-12645

A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server...

EUVD-2026-72813

A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server...

CVE-2026-12648

A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server...

CVE-2026-12648

CVE-2026-12648 is a Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM versions prior to 2026.2 . A remote authenticated attacker with low privileges can exploit this flaw to achieve arbitrary code execution on the server, with low attack complexity and no user interaction...

CVE-2026-12650

A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server...

EUVD-2026-72804

A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server...

CVE-2026-12745

Ivanti Neurons for ITSM versions before 2026.2 are affected by a Deserialization of Untrusted Data vulnerability that allows a remote unauthenticated attacker to execute arbitrary code on the server. The assigned CVSS 3.1 score is 9.8 (CRITICAL) , with a network attack vector, low complexity, no ...

CVE-2026-12745

A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server...

EUVD-2026-72797

A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server...

CVE-2026-12744

A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server...

CVE-2026-12744

A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server. The CNA-assigned CVSS 3.1 score is 9.8 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating n...

follina-msdt-threat-investigation

Follina — CVE-2022-30190 Threat Analysis Microsoft MSDT Remote Code Execution zero-day — active exploitation investigation by MUHAMMAD ZAWAR KHATTAK 🔗 View Full Writeup → 🧪 Scenario On a Friday evening, the team was alerted with a new RCE vulnerability actively being exploited in the wild. I was...