322729 matches found
WordPress Everest Backup plugin <= 2.3.13 - Remote Code Execution (RCE) vulnerability
Remote Code Execution RCE vulnerability discovered by Muhammad Sobirov in WordPress Plugin Everest Backup versions = 2.3.13...
Savannah lwIP SMTP client
ADVISORY SUMMARY Successful exploitation of this vulnerability could crash the device being accessed; a buffer overflow condition may allow remote code execution. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability...
CVE-2026-9998-Insecure-Deserialization-in-Blockchain-Oracle
10. CVE-2026-9998 – Insecure Deserialization in Blockchain Oracle Overview A blockchain oracle node deserializes data from a smart contract event using Python’s pickle, allowing an attacker to execute arbitrary commands. Severity: Critical Full Node Compromise Oracle Simulation & Exploit...
Exploit for Improper Handling of Exceptional Conditions in Apache Struts
Struts Patch-Gap Auditor A small Python tool that finds Apach...
USN-8866-1: Redis vulnerabilities
It was discovered that Redis did not properly manage memory when handling the TLS pending-data list. A remote attacker could possibly use this issue to execute arbitrary code. CVE-2026-81934 It was discovered that Redis incorrectly handled certain inputs when processing cluster bus packets. A...
USN-8866-1 redis vulnerabilities
It was discovered that Redis did not properly manage memory when handling the TLS pending-data list. A remote attacker could possibly use this issue to execute arbitrary code. CVE-2026-81934 It was discovered that Redis incorrectly handled certain inputs when processing cluster bus packets. A...
Zoho ManageEngine - Remote Code Execution
Zoho ManageEngine Password Manager Pro, PAM 360, and Access Manager Plus are susceptible to unauthenticated remote code execution via XML-RPC. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary...
CLEANSTART-2026-CF09659 Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586)
Security vulnerability affects the sonarqube package. Deserialization of Untrusted Data CWE-502 in the Elasticsearch machine learning component can lead to remote code execution via Object Injection CAPEC-586...
Prototype Pollution
Overview @graphql-tools/utils is a Common package containing utils and types for GraphQL tools Affected versions of this package are vulnerable to Prototype Pollution via the mergeDeep function, which fails to block reserved property keys such as proto, constructor, and prototype before recursive...
CVE-2026-76750: Deserialization of Untrusted Data
Deserialization of untrusted data vulnerabilities exist in the web interface of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code on the affected system...
CVE-2026-96890: Server-Side Request Forgery (SSRF)
A Server-Side Request Forgery SSRF vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to issue requests to attacker-controlled internal hosts, which could be chained to achieve remote code execution on the appliance. The secret...
Linux Distros Unpatched Vulnerability : CVE-2026-104711
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper neutralization of special elements used in an expression language statement 'Expression Language Injection' vulnerability in Apache Struts. If the...
PT-2026-107122
Name of the Vulnerable Software and Affected Versions AOS-S versions prior to 16.11.0032 Description Buffer overflow flaws exist in the affected interface, which could allow an unauthenticated remote attacker to execute arbitrary code. A buffer overflow occurs when a program writes more data to a...
PT-2026-106342
The ACPT Premium plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.66 via the render function. This is due to missing capability check on the REST API form creation endpoint and unsandboxed Twig environment rendering email templates. This makes ...
PT-2026-107152
Name of the Vulnerable Software and Affected Versions Arista Wi-Fi access points affected versions not specified Description A memory corruption issue exists in the wired uplink network endpoints of the access point. This flaw allows an unauthenticated attacker located on the same network segment...
Apache Commons JCS 3.2.1 Unauthenticated Java Deserialization
Summary JCS is a distributed caching system written in Java. It is intended to speed up applications by providing a means to manage cached data of various dynamic natures. Like any caching system, JCS is most useful for high read, low put applications. Latency times drop sharply and bottlenecks...
PT-2026-106396
Name of the Vulnerable Software and Affected Versions WooCommerce Designer Pro versions prior to 1.9.34 Description A code injection issue allows users with low-privileged subscriber accounts to execute arbitrary code on the server. Recommendations Update to version 1.9.34 or later...
CVE-2026-105844: Improperly Controlled Modification of Object Prototype Attributes
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an unauthenticated user can submit prototype-sensitive field paths when @payloadcms/plugin-import-export is enabled, causing unintended applicatio...
Linux Distros Unpatched Vulnerability : CVE-2026-49878
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In wpashandlerobustavscsrecvaction of robustav.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote code...
