CVE-2026-63125 Incus vulnerable to root RCE via image backup.yaml symlink

Incus is a system container and virtual machine manager. Prior to version 7.3.0, an unprivileged, project-confined Incus user a non-admin TLS/RBAC identity with cancreateimages and cancreateinstances can execute arbitrary code as root on the host. A crafted image ships backup.yaml as a symlink to...

CVE-2026-77806

SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injection via an X-Spip-Filtre HTTP request header that is mishandled by analyseresultatskel...

CVE-2026-73212

A flaw was found in Coturn. An authenticated client using the RFC 6062 TCP CONNECT relay path can bypass intended IPv4 denied-peer-ip range restrictions due to improper canonicalization of IPv4-compatible, 6to4, and NAT64 address forms. This vulnerability can lead to Server-Side Request Forgery...

CVE-2026-50112

SSRF via Metalink Mirror URL Resolution: An authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal targets. The Secondary Storage VM will retrieve the data and persist it as a template file, which can later be downloaded through normal...

CVE-2026-50112

Apache CloudStack versions 4.14.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0 are affected by two related vulnerabilities in template download handling. When a tenant registers a VM template with directDownload=true pointing to a .metalink file, the management server fetches the metalink XML...

EUVD-2026-63847

SSRF via Metalink Mirror URL Resolution: An authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal targets. The Secondary Storage VM will retrieve the data and persist it as a template file, which can later be downloaded through normal...

CVE-2026-18781

CVE-2026-18781 affects the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin in versions before 1.3.9.9 . The root cause is a control character filename bypass : the plugin strips characters from uploaded filenames but does not re-validate the resulting name, allowing an unau...

Exploit for Incorrect Resource Transfer Between Spheres in Openclaw

CVE-2026-25253 OpenClaw 1-Click RCE ★ CVE-2026-25253 OpenClaw...

CVE-2026-77645 Critical Remote Code Execution (RCE) vulnerability reported in Windchill

A critical remote code execution RCE vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data...

CVE-2026-77645

CVE-2026-77645 is a critical remote code execution (RCE) vulnerability in PTC Windchill and PTC FlexPLM , caused by deserialization of untrusted data . The CVSS 4.0 base score is 9.2 (CRITICAL) , with a network attack vector requiring no privileges and no user interaction . CISA's SSVC assessment...

EUVD-2026-63687

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG opened superuser connections without pinning searchpath in fillDefaultParameters in pkg/management/postgres/pool/profiles.go. A role holding DATABASE OWNER...

CVE-2026-55765 CloudNativePG: Cleartext role passwords recorded in pg_stat_statements allow privileged tenant roles to recover the PostgreSQL superuser credential and achieve RCE in the database pod

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG embedded cleartext role passwords in ALTER ROLE and CREATE ROLE statements generated by SetUserPassword in pkg/management/postgres/utils/roles.go and...

CVE-2026-18420 RCE via Prototype Pollution in OpenSearch Dashboards

Improper input validation in the Time Series Visual Builder TSVB plugin in OpenSearch Dashboards allows an authenticated remote user to execute arbitrary code on the server via a crafted JSON payload to the metrics visualization API endpoint. This issue is a form of prototype pollution that enabl...

Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)

Summary Backpack\CRUD\Stats::makeCurlRequest builds a shell command using unescaped input that originates from the HTTP Host header, then passes it to exec. A specially crafted Host header can break out of the shell argument and cause the server to execute arbitrary OS commands as the web user. T...

CVE-2026-2334 ) Missing Server-Side File Extension Validation in vsDesk

An issue was discovered in vsDesk v14.0101. An authenticated attacker with administrative privileges can bypass client-side file validation in the "Import via CSV" component due to a lack of server-side validation. This allows the upload of an arbitrary file, which can lead to Remote Code Executi...

GHSA-RRWH-6JRQ-WP5V

creationtimestamp| type| source ---|---|--- 2026-08-20 17:51:42+00:00| seen| https://bsky.app/profile/thestandup.bsky.social/post/3mtjsq4tke52x...

CVE-2026-18286

Aeon loadhumanactivitysegmentationdatasets Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aeon. User interaction is required to exploit this vulnerability in that the target must visit a malicio...

CVE-2026-18268

Kenwood DNR1007XR JKGenService Command Injection Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Kenwood DNR1007XR devices. An attacker must first obtain the ability to execute low-privileged code on the targe...

CVE-2026-18287 Aeon load_time_series_segmentation_benchmark Code Injection Remote Code Execution Vulnerability

Aeon loadtimeseriessegmentationbenchmark Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aeon. User interaction is required to exploit this vulnerability in that the target must visit a malicious...

CVE-2026-18285

The Aeon toolkit's load_rehab_pile_dataset method deserializes user-supplied data without validation, enabling arbitrary code execution in the process context. Exploitation requires user interaction (visiting a malicious page or opening a malicious file). ZDI-CAN-28749. A fix commit exists at htt...