EUVD-2026-93231

Subscriber Remote Code Execution RCE in WooCommerce Designer Pro = 1.9.33 versions...

CVE-2026-32568 WordPress WooCommerce Designer Pro plugin <= 1.9.33 - Remote Code Execution (RCE) vulnerability

Subscriber Remote Code Execution RCE in WooCommerce Designer Pro = 1.9.33 versions...

CVE-2026-32568

The WooCommerce Designer Pro plugin for WordPress (versions

CVE-2026-105701

The ACPT Premium plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.66 via the render function. This is due to missing capability check on the REST API form creation endpoint and unsandboxed Twig environment rendering email templates. This makes ...

CVE-2026-105701 ACPT (Premium) <= 2.0.66 - Authenticated (Subscriber+) Remote Code Execution via REST API Email Template

The ACPT Premium plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.66 via the render function. This is due to missing capability check on the REST API form creation endpoint and unsandboxed Twig environment rendering email templates. This makes ...

CVE-2026-105701

The ACPT (Premium) plugin for WordPress is vulnerable to Remote Code Execution (RCE) in all versions up to and including 2.0.66 . The root cause is a missing capability check on the REST API form creation endpoint combined with an unsandboxed Twig environment used for rendering email templates. A...

EUVD-2026-92986

The ACPT Premium plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.66 via the render function. This is due to missing capability check on the REST API form creation endpoint and unsandboxed Twig environment rendering email templates. This makes ...

CVE-2026-105701 ACPT (Premium) <= 2.0.66 - Authenticated (Subscriber+) Remote Code Execution via REST API Email Template

The ACPT Premium plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.66 via the render function. This is due to missing capability check on the REST API form creation endpoint and unsandboxed Twig environment rendering email templates. This makes ...

WordPress Everest Backup plugin <= 2.3.13 - Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability discovered by Muhammad Sobirov in WordPress Plugin Everest Backup versions = 2.3.13...

Savannah lwIP SMTP client

ADVISORY SUMMARY Successful exploitation of this vulnerability could crash the device being accessed; a buffer overflow condition may allow remote code execution. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability...

CVE-2026-9998-Insecure-Deserialization-in-Blockchain-Oracle

10. CVE-2026-9998 – Insecure Deserialization in Blockchain Oracle Overview A blockchain oracle node deserializes data from a smart contract event using Python’s pickle, allowing an attacker to execute arbitrary commands. Severity: Critical Full Node Compromise Oracle Simulation & Exploit...

Exploit for Improper Handling of Exceptional Conditions in Apache Struts

Struts Patch-Gap Auditor A small Python tool that finds Apach...

USN-8866-1: Redis vulnerabilities

It was discovered that Redis did not properly manage memory when handling the TLS pending-data list. A remote attacker could possibly use this issue to execute arbitrary code. CVE-2026-81934 It was discovered that Redis incorrectly handled certain inputs when processing cluster bus packets. A...

USN-8866-1 redis vulnerabilities

It was discovered that Redis did not properly manage memory when handling the TLS pending-data list. A remote attacker could possibly use this issue to execute arbitrary code. CVE-2026-81934 It was discovered that Redis incorrectly handled certain inputs when processing cluster bus packets. A...

Zoho ManageEngine - Remote Code Execution

Zoho ManageEngine Password Manager Pro, PAM 360, and Access Manager Plus are susceptible to unauthenticated remote code execution via XML-RPC. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary...

CLEANSTART-2026-CF09659 Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586)

Security vulnerability affects the sonarqube package. Deserialization of Untrusted Data CWE-502 in the Elasticsearch machine learning component can lead to remote code execution via Object Injection CAPEC-586...

Prototype Pollution

Overview @graphql-tools/utils is a Common package containing utils and types for GraphQL tools Affected versions of this package are vulnerable to Prototype Pollution via the mergeDeep function, which fails to block reserved property keys such as proto, constructor, and prototype before recursive...

PT-2026-107021

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description A use after free issue exists in V8, the open-source high-performance JavaScript and WebAssembly engine. This flaw allows a remote attacker to execute arbitrary code within the sandbox ...

RockyLinux 10 : freerdp (RLSA-2026:75570)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:75570 advisory. FreeRDP: freerdp-proxy: FreeRDP: Information disclosure via uninitialized heap memory in Save Session Info PDU CVE-2026-85089 FreeRDP: FreeRDP: Denial ...

CVE-2026-76750: Deserialization of Untrusted Data

Deserialization of untrusted data vulnerabilities exist in the web interface of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code on the affected system...