592919 matches found
CVE-2026-91051 EWWW Image Optimizer 8.6.0 - 8.7.7 - Author+ PHP Object Injection via 'eio_page_settings' Post Meta
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote co...
CVE-2026-91051
The EWWW Image Optimizer WordPress plugin versions before 8.8.0 (specifically versions 8.6.0 - 8.7.7 ) is vulnerable to PHP Object Injection . Authenticated users with author-level permissions can store a serialized value in a post meta field (specifically 'eio_page_settings' ). When the post is ...
CVE-2026-91051 EWWW Image Optimizer 8.6.0 - 8.7.7 - Author+ PHP Object Injection via 'eio_page_settings' Post Meta
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote co...
CVE-2026-75873 Zella Theme < 2.6.3 - Unauthenticated Arbitrary File Upload
The Zella Theme WordPress theme before 2.6.3 does not perform any capability or nonce check on one of its font upload actions, which is available to unauthenticated users, allowing them to upload arbitrary files, including PHP ones, and achieve remote code execution...
CVE-2026-75873
The Zella Theme WordPress theme, specifically versions before 2.6.3 , is vulnerable to unauthenticated arbitrary file upload. The root cause is a lack of capability or nonce checks on a font upload action. Attackers can exploit this to upload arbitrary files, including PHP files , leading to remo...
EUVD-2026-89637
The Zella Theme WordPress theme before 2.6.3 does not perform any capability or nonce check on one of its font upload actions, which is available to unauthenticated users, allowing them to upload arbitrary files, including PHP ones, and achieve remote code execution...
CVE-2026-75873 Zella Theme < 2.6.3 - Unauthenticated Arbitrary File Upload
The Zella Theme WordPress theme before 2.6.3 does not perform any capability or nonce check on one of its font upload actions, which is available to unauthenticated users, allowing them to upload arbitrary files, including PHP ones, and achieve remote code execution...
CVE-2021-41773-L-
CVE-2021-41773 🐛 Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like...
CVE-2025-55182
🚨 CVE-2025-55182 — React2Shell CVE-2025-55182 es una vulnerabilidad crítica de Ejecución Remota de Código RCE que afecta a los Componentes del Servidor de React RSC. 📌 Resumen Esta vulnerabilidad permite a atacantes no autenticados ejecutar código arbitrario en servidores vulnerables. El problema...
CVE-2026-102331
A flaw was found in chromium-browser. This flaw allows a remote attacker to achieve arbitrary code execution outside of the application sandbox via a buffer overflow in the ANGLE Almost Native Graphics Engine component. An attacker could exploit this vulnerability by enticing a user to visit a...
Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution
Cybersecurity researchers have disclosed technical details of a recently patched critical security flaw in Citrix NetScaler ADC and Gateway that has come under active exploitation in the wild. The vulnerability, tracked as CVE-2026-88772 CVSS score: 9.5, has been described as a memory overflow bu...
Security Bulletin: This Power System update is being released to address CVE-2026-96263
Summary Power Systems Firmware is affected by a vulnerability in the host firmware boot process image validation path. An attacker with service access to the service processor can supply a maliciously crafted code update image, allowing arbitrary code to be executed on the host system. Successful...
CVE-2026-103111
A flaw was found in pcre2. When an application processes attacker-controlled regular expressions using certain Just-In-Time JIT compiler interfaces, an out-of-bounds write with arbitrary data can occur. An attacker could exploit this vulnerability to achieve arbitrary code execution, corrupt...
CVE-2022-47986
CVE-2022-47986 Aspera Faspex Pre Auth RCE https://blog.assetnote.io/2023/02/02/pre-auth-rce-aspera-faspex/ Poc Usage: python3 poc.py https://xxxxx whoami...
CVE-2021-22911
Updated exploit for CVE-2021-22911 Rocket.Chat 3.12.1 - NoSQL Injection to RCE Unauthenticated original credits to : https://www.exploit-db.com/exploits/50108 Setup Create python virtual environment and install deps $ python -m venv venv $ source venv/bin/activate $ pip install requests oathtool...
CVE-2022-43571
CVE-2022-43571 CVE-2022-43571 Splunk RCE: mi viaje personal para dar color a tu vida Solo porque recibí la declaración de mi departamento de TI de que no hay motivos para una actualización de SPLUNK, analicé esta vulnerabilidad CVE-2022-43571 para demostrar lo contrario en cuanto a la ejecución...
Security Bulletin: This Power System update is being released to address CVE-2026-96264
Summary Power Systems Firmware is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware runtime attribute storage, allowing arbitrary code to be...
Security Bulletin: This Power System update is being released to address CVE-2026-96262
Summary Power Systems Firmware is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware runtime attribute storage, allowing arbitrary code to be...
CVE-2026-102875
A flaw was found in VLC media player. An attacker can achieve arbitrary code execution by convincing a user to open a maliciously crafted skin archive. Because the theme loader fails to properly validate member file paths within the archive, files containing directory traversal sequences can be...