Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch

Threat actors are beginning to probe for a newly patched critical vulnerability in Oracle E-Business Suite EBS, according to threat intelligence firm Defused Cyber. The vulnerability in question is CVE-2026-101767 CVSS score: 9.8 , a case of improper authentication in the Oracle Application Objec...

CVE-2026-93515 .Org Server Present Extension Use-After-Free

A use-after-free in presentclearwindownotifies in the X.org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by malicious X clients to crash or potentially execute code in the X server context...

EUVD-2026-112041

A use-after-free in presentclearwindownotifies in the X.org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by malicious X clients to crash or potentially execute code in the X server context...

CVE-2026-93515

A use-after-free vulnerability exists in present_clear_window_notifies() within the X.org X Server (versions before 21.1.25 ) and X Wayland (versions before 24.1.14 ). The flaw occurs because notify entries are not unlinked from the per-window list before freeing window_priv. If a window is subse...

CVE-2026-93515 .Org Server Present Extension Use-After-Free

A use-after-free in presentclearwindownotifies in the X.org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by malicious X clients to crash or potentially execute code in the X server context...

CVE-2026-93515

A use-after-free in presentclearwindownotifies in the X.org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by malicious X clients to crash or potentially execute code in the X server context...

CVE-2026-67074

The software HCL BigFix AEX is affected by a Remote Code Execution vulnerability. This flaw may allow an attacker to execute arbitrary code with the same privileges as the affected application or service, which could result in unauthorized access , data exposure , or complete system compromise . ...

EUVD-2026-112029

HCL BigFix AEX is affected by a Remote Code Execution Vulnerability . It may allow attackers to execute code with the privileges of the affected application or service, potentially leading to unauthorized access, data exposure, or system compromise...

CVE-2026-67074 HCL BigFix AEX is affected by multiple security vulnerabilities.

HCL BigFix AEX is affected by a Remote Code Execution Vulnerability . It may allow attackers to execute code with the privileges of the affected application or service, potentially leading to unauthorized access, data exposure, or system compromise...

CVE-2026-114278

The che-machine-exec service constructs a shell command by concatenating user-controlled input the username and namespace fields from the /exec/init and /exec/config JSON endpoints into a double-quoted sh -c "echo "..." ..." invocation without any escaping. When che-machine-exec is run with...

PHP2shell

💀 PHP2shell One-click weaponized PoC for CVE-2026-109618 & CVE-2026-109619 Targeting vulnerable PHP + Apache modphp prefork deployments. ⚠️ WARNING: This tool is provided strictly for authorized security testing, CTFs, and educational research. Do not use this against infrastructure you do not own...

CVE-2015-1427

CVE-2015-1427 Parameters -u single url -l specify url file -c specify command...

EUVD-2026-112026

The che-machine-exec service constructs a shell command by concatenating user-controlled input the username and namespace fields from the /exec/init and /exec/config JSON endpoints into a double-quoted sh -c "echo "..." ..." invocation without any escaping. When che-machine-exec is run with...

CVE-2026-114278 Unauthenticated Command Injection via kubeconfig Username in che-machine-exec

The che-machine-exec service constructs a shell command by concatenating user-controlled input the username and namespace fields from the /exec/init and /exec/config JSON endpoints into a double-quoted sh -c "echo "..." ..." invocation without any escaping. When che-machine-exec is run with...

CVE-2026-114278

The che-machine-exec service is vulnerable to unauthenticated command injection because it constructs shell commands by concatenating user-controlled input from the /exec/init and /exec/config JSON endpoints without proper escaping. Specifically, the username and namespace fields are inserted int...

CVE-2026-114278 Unauthenticated Command Injection via kubeconfig Username in che-machine-exec

The che-machine-exec service constructs a shell command by concatenating user-controlled input the username and namespace fields from the /exec/init and /exec/config JSON endpoints into a double-quoted sh -c "echo "..." ..." invocation without any escaping. When che-machine-exec is run with...

Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers

A critical 16-year-old flaw in EDK II , the open-source code that most hardware makers use to build UEFI firmware, can allow an attacker to run code on a machine before its operating system loads, but only while the machine is booting over the network. UEFI firmware is the software that runs firs...

CVE-2026-42945

NGINX Rift RCE Proof of concept for CVE-2026-42945 , a critical heap buffer overflow in NGINX's ngxhttprewritemodule introduced in 2008. The bug enables unauthenticated remote code execution against servers using rewrite and set directives. This vulnerability — along with three other memory...

CVE-2026-42533

CVE-2026-42533 — nginx two-pass capture clobbering Pre-auth heap overflow + info leak in nginx 0.9.6–1.30.3 / mainline ≤1.31.2 complex-value script engine; CVSS 9.2. Two trigger surfaces share the same root cause: HTTP regex location + regex map and stream sslpreread + SNI + regex map. In-depth...

CVE-2026-103780

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Stack-based Buffer Overflow vulnerability. An...