Critical React2Shell Flaw Added to CISA KEV After Confirmed Active Exploitation

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Friday formally added a critical security flaw impacting React Server Components RSC to its Known Exploited Vulnerabilities KEV catalog following reports of active exploitation in the wild. The vulnerability, CVE-2025-55182 CVSS...

Exploit for Deserialization of Untrusted Data in Facebook React

React2Shell - CVE-2025-55182 Lab A comprehensive laboratory f...

Exploit for CVE-2025-55182

CVE-2025-55182 / CVE-2025-66478 Vulnerability Scanner React...

CVE-2025-60801

jshERP up to commit fbda24da was discovered to contain an unauthenticated remote code execution RCE vulnerability via the jsherp function...

CVE-2025-60801

jshERP up to commit fbda24da was discovered to contain an unauthenticated remote code execution RCE vulnerability via the jsherp function...

CVE-2025-60801

jshERP up to commit fbda24da was discovered to contain an unauthenticated remote code execution RCE vulnerability via the jsherp function...

Medusa Ransomware Exploiting GoAnywhere MFT Flaw, Confirms Microsoft

Latest reports suggest the critical GoAnywhere MFT vulnerability CVE-2025-10035, CVSS 10.0 is actively exploited by the Medusa ransomware gang for unauthenticated RCE. Patch immediately...

EUVD-2010-5299

Malware in sbrugna...

EUVD-2019-3650

Malware in sbrugna...

CVE-2025-10363 Unauthenticated RCE via .NET Deserialization in Topal Finance Software

Deserialization of Untrusted Data vulnerability in Topal Solutions AG Topal Finanzbuchhaltung on Windows allows Remote Code Execution.This issue affects at least Topal Finanzbuchhaltung: 10.1.5.20 and is fixed in version 11.2.12.00...

Exploit for Code Injection in Bitapps File_Manager

CVE-2024-7627 — Bit File Manager WordPress Unauthenticated R...

EUVD-2025-24840

Malicious code in bioql PyPI...

CVE-2025-10035 - Critical unauthenticated RCE in GoAnywhere MFT

Overview On September 18, 2025, Fortra published an advisory for CVE-2025-10035. This new vulnerability affects GoAnywhere MFT, an enterprise managed file transfer solution, and allows an attacker to achieve unauthenticated remote code execution. GoAnywhere MFT is a file transfer solution that ha...

CVE-2025-48703

CWP aka Control Web Panel or CentOS Web Panel before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the ttotal parameter in a filemanager changePerm request. A valid non-root username must be known...

CVE-2010-20121

EasyFTP Server versions up to 1.7.0.11 contain a stack-based buffer overflow vulnerability in the FTP command parser. When processing the CWD Change Working Directory command, the server fails to properly validate the length of the input string, allowing attackers to overwrite memory on the stack...

CVE-2010-10013

An unauthenticated remote command execution vulnerability exists in AjaXplorer now known as Pydio Cells versions prior to 2.6. The flaw resides in the checkInstall.php script within the access.ssh plugin, which fails to properly sanitize user-supplied input to the destServer GET parameter. By...

CVE-2010-10013

CVE-2010-10013 describes an unauthenticated remote command execution in AjaXplorer (now Pydio Cells) versions before 2.6. The vulnerability resides in the checkInstall.php script of the access.ssh plugin, which fails to sanitize input passed to the destServer GET parameter. By injecting shell met...

Exploit for Deserialization of Untrusted Data in Microsoft

CVE-2025-53770 – Microsoft SharePoint Server 2019 Unauthentica...

Vulnerabilities fixed in Trend Micro Apex One

Trend Micro has fixed vulnerabilities in the Apex One management console. The vulnerability in the management console allows a remote attacker without authentication to arbitrarily upload code and execute commands on affected installations. Both CVEs are similar, it just affects different CPU...

SUSE CVE-2025-48710

kro Kube Resource Orchestrator 0.1.0 before 0.2.1 allows users with permission to create or modify ResourceGraphDefinition resources to supply arbitrary container images. This can lead to a confused-deputy scenario where kro's controllers deploy and run attacker-controlled images, resulting in...