CVE-2026-65941

CVE-2026-65941 affects WhatsUp Gold releases prior to 2026.0.2. An unauthenticated remote attacker with network access to the affected IIS-backed service can execute arbitrary code in the context of the IIS application service account. The CVE is documented by NVD and CVE records, with a high imp...

EUVD-2026-57267

In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account...

Important: Red Hat Security Advisory: nodejs:24 security update

An update for the nodejs:24 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2026-73263

CVE-2026-73263 affects Prowler prior to 5.36.0. The Kubernetes provider connection test incorrectly accepted kubeconfig_content with a legacy GCP auth-provider containing config.cmd-path and config.cmd-args because kubeconfig_contains_exec_auth only checked exec blocks. When loaded via config.loa...

Exploit for CVE-2026-64638

Require...

WordPress Fluent Forms Pro Add On Pack plugin 6.2.7 - Backdoor vulnerability

Backdoor vulnerability discovered by ? in WordPress Plugin Fluent Forms Pro Add On Pack versions 6.2.7...

CVE-2026-67282

CVE-2026-67282 concerns the Joomla extension Fabrik (pre-4.6.8). The NVD/CVE listings describe an unauthenticated remote code execution flaw where an attacker can execute arbitrary code via the frontend listfilter model. Affected component: Fabrik frontend (Joomla extension) before version 4.6.8....

EUVD-2026-57151

Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik 4.6.8 - An unauthenticated attacker could execute arbitrary code by using the frontend listfilter model...

Exploit for CVE-2026-20349

cve-id Donate Support the maintenance of this project wit...

ThinkPHP 5.0.23 - Remote Code Execution

An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PHP code via crafted use of the filter parameter, as demonstrated by the s=index/\think\Request/input&filter=phpinfo&data=1 query string. id: CVE-2018-20062 info: name: ThinkPHP...

Exchange Server - Remote Code Execution

Microsoft Exchange Server is vulnerable to a remote code execution vulnerability. This CVE ID is unique from CVE-2021-31196, CVE-2021-31206. id: CVE-2021-34473 info: name: Exchange Server - Remote Code Execution author: arcc,intx0x80,dwisiswant0,r3dg33k severity: critical description: | Microsoft...

CVE-2026-18391 WooCommerce Subscriptions < 9.1.0 - Unauthenticated RCE via PHP Object Injection

The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain...

PT-2026-71065

Name of the Vulnerable Software and Affected Versions Fortinet FortiOS versions 7.6.1 through 7.6.6 Description A stack-based buffer overflow occurs in the WAD daemon when the explicit proxy is configured with Kerberos authentication and SOCKS enabled. An unauthenticated attacker can exploit this...

PT-2026-71267

Name of the Vulnerable Software and Affected Versions IBM Informix affected versions not specified Description Remote code execution is possible in the sq sgkprepare function due to an unchecked length field within the SQL Interface. Recommendations At the moment, there is no information about a...

PT-2026-71040

Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik 4.6.8 - An unauthenticated attacker could execute arbitrary code by using the frontend listfilter model...

PT-2026-71367

Name of the Vulnerable Software and Affected Versions UpSnap versions prior to 5.4.0 Description An OS command injection flaw exists in the device management functionality. This occurs due to unsafe shell command template interpolation using the ip and mac fields. An authenticated low-privileged...

CVE-2026-73248 calibre: Bypass of Python template restrictions via nested `template()` leading to RCE

calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled compositetemplate metadata from a malicious EPUB, OPF, PDF, or similar file through program: and a nested template call whose formatter does not inherit allowpythontemplates=False, allowing a nested python:...

CVE-2026-71439 vulnerabilities

Vulnerabilities for packages: langfuse...

EUVD-2026-56941

An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform remote code execution through specially crafted requests...

CVE-2026-13457

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to unauthenticated cryptographic key disclosure and potential RCE in all versions up to and including 0.1.3.6. The root cause is storing an encrypted options file as options-{migrate_key}.txt in wp-content/ins...