CVE-2026-79988 Authenticated RCE through Twig sandbox escape

The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities...

PT-2026-82558

Name of the Vulnerable Software and Affected Versions Craft CMS affected versions not specified Description The Twig sandbox mechanism is configured to allow dangerous functionality from the Yii framework. This configuration allows authenticated users to achieve Remote Code Execution RCE, which i...

CVE-2026-78416 Authenticated RCE via `condition.config` JSON cleanse bypass

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interprete...

CVE-2026-78416 Authenticated RCE via `condition.config` JSON cleanse bypass

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interprete...

CVE-2025-63080 Authenticated RCE in KAON PG5298

Firmware in KAON PG5298A and PG5298B routers allow an authenticated user to send crafted JSON-RPC requests and perform operations not possible via GUI, e.g. system file read or command execution. This vulnerability has been fixed in firmware version: 3.0.82 for PG5298A and 4.0.82 for PG5298B...

CVE-2026-54449 LangBot: Authenticated RCE Via MCP Configuration

LangBot is a global IM bot platform designed for LLMs. In version 4.10.7 and earlier, any authenticated user can add or change an STDIO MCP server configuration without an adequate authorization boundary. In src/langbot/pkg/provider/tools/loaders/mcp.py, StdioServerParameters accepts the configur...

CVE-2026-76357

In Splunk SOAR on-premises versions below 8.6.0, the REST API fails to enforce role requirements and does not confine user-supplied file paths to the temporary directory, enabling an authenticated, role-less user to submit crafted paths and achieve arbitrary code execution (CVSS 7.6, HIGH). No in...

CVE-2026-76335

CVE-2026-76335 is a remote code execution vulnerability in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 . An authenticated user without the edit_manager_xml capability can write a malicious Splunk Web Manager XML configuration . When the same user opens the affected page, S...

CVE-2026-73679

ImpressCMS has an authenticated remote code execution vulnerability in the custom tag module. The issue allows authenticated administrators to run arbitrary PHP by storing a payload in a custom tag with PHP type enabled. The application decodes HTML-encoded content via undoHtmlSpecialChars() and ...

CVE-2026-73679 ImpressCMS Authenticated RCE via PHP Custom Tag eval()

ImpressCMS contains an authenticated remote code execution vulnerability in the custom tag module that allows authenticated administrators to execute arbitrary PHP code by storing a malicious payload in a custom tag with PHP type enabled. The application decodes HTML-encoded content via...

Linux Distros Unpatched Vulnerability : CVE-2026-48554

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to authenticated remote code execution via unfiltered NOTIFICATION-family macro...

Tenable Security Center SCAP Audit File Command Injection

Tenable Security Center prior to 6.9.0 allows an authenticated user to achieve command execution as the web service account tns via the SCAP audit file upload flow. Filesystem::saveTmp builds staged upload filenames from the raw client-supplied context form parameter tempnam prefix, which is not...

UBUNTU-CVE-2026-48553

Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 are vulnerable to authenticated remote code execution via custom-variable macro injection through the Nagios Remote Data Processor NRDP. When a custom variable defined on a host, service, or contact is referenced in a shell-executed command...

CVE-2026-48554

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to authenticated remote code execution via unfiltered NOTIFICATION-family macro substitution through the comdata parameter. When a notification command references $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ in a...

CVE-2026-48554

CVE-2026-48554 affects Nagios Core (before 4.5.14) and Nagios XI (before 2026R1.7). An authenticated remote code execution flaw exists via unfiltered NOTIFICATION-family macro substitution in the com_data parameter. If a notification command uses $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ in a...

CVE-2026-48553

Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 are vulnerable to authenticated remote code execution via custom-variable macro injection through the Nagios Remote Data Processor NRDP. When a custom variable defined on a host, service, or contact is referenced in a shell-executed command...

CVE-2026-72778 Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.config

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in the control panel element-search condition handling. Craft cleanses the outer request-controlled condition array via Component::cleanseConfig, but...

CVE-2026-72778 Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.config

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in the control panel element-search condition handling. Craft cleanses the outer request-controlled condition array via Component::cleanseConfig, but...

CVE-2026-72778

Summary: CVE-2026-72778 affects Craft CMS 4.x (from 4.0.0-RC1 up to 4.18.2) and 5.x (from 5.0.0-RC1 up to 5.10.6). The vulnerability is an authenticated remote code execution in the control panel element-search condition handling. The root cause is that Condition::createCondition() decodes and me...

CVE-2026-72901 Dokploy: Remote Code Execution via volume-backup

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy allows an authenticated low-privilege member to execute arbitrary commands on the control-plane host because the volumeName field accepted by volumeBackup.create and volumeBackup.runManually is interpolated...