EUVD-2026-71956

AutoAgent contains an unauthenticated remote code execution vulnerability in the TCP server that binds to all interfaces and executes attacker-supplied commands as root. Attackers can connect to the exposed communication port and execute arbitrary bash commands within the container, gaining acces...

CVE-2026-86124

AutoAgent (HKUDS/AutoAgent) contains an unauthenticated remote code execution vulnerability in its sandbox TCP command server . The server binds to all network interfaces and executes attacker-supplied commands as root without requiring authentication. An attacker who can reach the exposed commun...

CVE-2026-86121 Cua computer-server before 0.3.42 Unauthenticated RCE via Desktop Control

Cua computer-server versions before 0.3.42 skip authentication when the CONTAINERNAME environment variable is unset and bind to all interfaces by default, allowing unauthenticated attackers to execute arbitrary commands. Attackers can reach TCP port 8000 to run shell commands via the runcommand...

CVE-2026-86121

Cua computer-server (by Cua, GitHub: trycua/cua) versions before 0.3.42 skip authentication when the CONTAINER_NAME environment variable is unset and bind to all network interfaces by default. This allows an unauthenticated attacker to reach TCP port 8000 and execute arbitrary shell commands via ...

CVE-2026-86121 Cua computer-server before 0.3.42 Unauthenticated RCE via Desktop Control

Cua computer-server versions before 0.3.42 skip authentication when the CONTAINERNAME environment variable is unset and bind to all interfaces by default, allowing unauthenticated attackers to execute arbitrary commands. Attackers can reach TCP port 8000 to run shell commands via the runcommand...

EUVD-2026-71953

Cua computer-server versions before 0.3.42 skip authentication when the CONTAINERNAME environment variable is unset and bind to all interfaces by default, allowing unauthenticated attackers to execute arbitrary commands. Attackers can reach TCP port 8000 to run shell commands via the runcommand...

CVE-2025-32433-Eploit

CVE-2025-32433-Eploit Erlang/OTP SSH 存在预认证远程代码执行漏洞 SSH Erlang RCE 利用程序 构造 SSH 载荷以在易受攻击的服务器上执行任意 Erlang 命令。 用法： root@kitploit: python3 exploit.py -t targets.txt -p 2222 -o results.log 免责声明： 本工具仅供教育目的及授权安全测试使用。请勿在未获明确许可的系统上使用。 联系方式 https://t.me/GOTOCVE...

IBM WebSphere Java Object Deserialization - Remote Code Execution

IBM Websphere Application Server 7, 8, and 8.5 have a deserialization vulnerability in the SOAP Connector port 8880 by default. id: CVE-2015-7450 info: name: IBM WebSphere Java Object Deserialization - Remote Code Execution author: wdahlenb severity: critical description: IBM Websphere Applicatio...

VulnCheck KEV: CVE-2025-60698

A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1FW102B02 within the prog.cgi and rc binaries. The sub432F60 function in prog.cgi stores user-supplied SetSysLogSettings/IPAddress values in NVRAM via nvramsafeset"SysLogRemoteIPAddress", .... These values are...

PT-2026-86392

Name of the Vulnerable Software and Affected Versions Cua computer-server versions prior to 0.3.42 Description Authentication is bypassed when the CONTAINER NAME environment variable is unset, as the server binds to all interfaces by default. This allows unauthenticated attackers to execute...

CVE-2026-79423

An authenticated remote code execution RCE vulnerability in the adminconfig.php component of seacms v13.6 allows attackers to execute arbitrary code via a crafted POST request...

CVE-2026-9317 Nango < 0.71.6 Missing Authentication RCE via runner tRPC server

Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests ...

Exploit for Server-Side Request Forgery in Sonicwall Sma8200V

SonicWall SMA 1000 — CVE-2026-83548 / CVE-2026-83549 Exposure...

CVE-2026-44402 Voltronic Power SNMP Web Pro 1.1 Unauthenticated RCE via upload.cgi

Voltronic Power SNMP Web Pro 1.1 contains an unauthenticated remote code execution vulnerability in the upload.cgi firmware update endpoint that allows remote attackers to execute arbitrary commands as root by uploading a crafted tar archive without valid credentials. Attackers can supply a...

CVE-2026-44402

Voltronic Power SNMP Web Pro 1.1 suffers from an unauthenticated remote code execution vulnerability in the upload.cgi firmware update endpoint. The backend fails to validate session cookies (a single Cookie: -http-session-=NOT_VALID header bypasses authentication), and the firmware install proce...

EUVD-2026-71267

Voltronic Power SNMP Web Pro 1.1 contains an unauthenticated remote code execution vulnerability in the upload.cgi firmware update endpoint that allows remote attackers to execute arbitrary commands as root by uploading a crafted tar archive without valid credentials. Attackers can supply a...

Exploit for Deserialization of Untrusted Data in Jetbrains Teamcity

CVE-2026-63077 — JetBrains TeamCity Unauthenticated RCE !Py...

CVE-2026-82923 AI Website Builder (GitHub build) 1.0.0 - Unauthenticated RCE via Unprotected REST Routes

The AI Website Builder WordPress plugin GitHub build 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated attackers to install and activate plugins and themes, import content from a URL under their control, write a file of their choosing into th...

CVE-2026-82923

The AI Website Builder WordPress plugin (GitHub build 1.0.0 ) lacks any authorization or nonce check on its REST API routes. This allows an unauthenticated attacker to install and activate plugins and themes, import content from an attacker-controlled URL, write an arbitrary file into the uploads...

Malicious Package

Overview @yuva2210/okx-poc-rce-impact is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...