ManageEngine ADAudit Plus < Build 8606 Unauthenticated RCE

The ManageEngine ADAudit Plus running on the remote host is prior to build 8606. It is, therefore, affected by an unauthenticated remote code execution vulnerability: - Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by unauthenticated remote code execution due to the...

Oracle PeopleSoft PeopleTools Multiple Vulnerabilities (CSPU Jun 2026)

The version of Oracle PeopleSoft PeopleTools installed on the remote host is 8.61.x prior to 8.61.20 or 8.62.x prior to 8.62.10. It is, therefore, affected by multiple vulnerabilities as noted in the June 2026 Critical Security Patch Update advisory, whose patches also resolve Oracle Security Ale...

Security update for valkey (important)

openSUSE security update: security update for valkey ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21485-1 Rating: important References: bsc1272442 bsc1272443 Cross-References: CVE-2026-56684 CVE-2026-63639 CVSS scores: CVE-2026-56684 SUSE : 7.5...

EUVD-2026-51645

An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute arbitrary code via a crafted request...

The vulnerability of Google Chrome browser’s Blink rendering module allows a hacker to execute arbitrary code.

The vulnerability of the Blink rendering module in Google Chrome browsers relates to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the Tab Groups component in Google Chrome allows a hacker to execute arbitrary code.

The vulnerability of Google Chrome’s Tab Groups component is related to the use of memory after it is freed. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code...

The vulnerability of the Aura component in Google Chrome browser allows a hacker to execute arbitrary code.

The vulnerability of the Aura component in Google Chrome browsers relates to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

The vulnerability of the WebAudio component in the Google Chrome browser allows a hacker to execute arbitrary code.

The vulnerability of the WebAudio component in the Google Chrome browser is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

The vulnerability of Google Chrome’s user interface allows a hacker to execute arbitrary code.

The vulnerability of Google Chrome’s user interface relates to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2026-66858

Name of the Vulnerable Software and Affected Versions Hugo Leisink Hiawatha versions prior to 12.2 Description A flaw allows a remote attacker to execute arbitrary code by sending a specially crafted request to the server. Recommendations Update Hugo Leisink Hiawatha to version 12.2 or later...

KLA91185 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. A remot...

CVE-2026-68502

LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn's lazyc2.py registers an unauthenticated Socket.IO input event handler that dispatches data.get'value' to LazyOwnShell.onecmd, reaching LazyOwnShell.docmd and subprocess.callcommand,...

CVE-2026-66803

Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network...

CVE-2026-68502 LazyOwn: Unauthenticated Socket.IO `input` Event Reaches LazyOwn Command Dispatcher — Unauthenticated RCE

LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn's lazyc2.py registers an unauthenticated Socket.IO input event handler that dispatches data.get'value' to LazyOwnShell.onecmd, reaching LazyOwnShell.docmd and subprocess.callcommand,...

CVE-2026-68502 LazyOwn: Unauthenticated Socket.IO `input` Event Reaches LazyOwn Command Dispatcher — Unauthenticated RCE

LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn's lazyc2.py registers an unauthenticated Socket.IO input event handler that dispatches data.get'value' to LazyOwnShell.onecmd, reaching LazyOwnShell.docmd and subprocess.callcommand,...

CVE-2026-68502

The CVE affects the LazyOwn RedTeam/APT Framework. Prior to version 0.2.154, lazyc2.py registers an unauthenticated Socket.IO input event handler that dispatches data.get('value') to LazyOwnShell.one_cmd, which reaches LazyOwnShell.do_cmd and invokes subprocess.call(command, shell=True). This all...

CVE-2026-66803 Azure Cosmos DB Remote Code Execution Vulnerability

...

CVE-2026-66803

CVE-2026-66803 affects Azure Cosmos DB and is described as improper access control that allows an unauthorized attacker to execute code over a network. The connected records corroborate this as a remote code execution vulnerability, with a CVSSv3.1 base score of 10.0 (CRITICAL) and network attack...

CVE-2026-66803 Azure Cosmos DB Remote Code Execution Vulnerability

...

CVE-2026-67206

Wolf CMS through 0.8.3.1 contains a remote code execution vulnerability in FileManagerController that allows authenticated attackers to create arbitrary PHP files by exploiting missing file extension validation in the createfile and save functions. Attackers with the filemanagermkfile capability...