EUVD-2026-45945

Windu CMS does not validate types of uploaded files. An authenticated attacker can upload arbitrary files, including PHP. This can lead to Remote Code Execution. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other...

CVE-2026-57311

Windu CMS is affected by CVE-2026-57311 due to lack of validation for uploaded file types. An authenticated attacker can upload arbitrary files, including PHP, which can lead to Remote Code Execution. The vulnerability has been confirmed in version 4.1 and may affect other versions; the available...

CVE-2026-57311 Unrestricted Upload of File with Dangerous Type in Windu CMS

Windu CMS does not validate types of uploaded files. An authenticated attacker can upload arbitrary files, including PHP. This can lead to Remote Code Execution. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other...

CVE-2026-57311

Windu CMS does not validate types of uploaded files. An authenticated attacker can upload arbitrary files, including PHP. This can lead to Remote Code Execution. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other...

CVE-2026-57311 Unrestricted Upload of File with Dangerous Type in Windu CMS

Windu CMS does not validate types of uploaded files. An authenticated attacker can upload arbitrary files, including PHP. This can lead to Remote Code Execution. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other...

react-router: React Router: Remote Code Execution via prototype pollution in Framework Mode

A flaw was found in React Router when operating in Framework Mode. A remote attacker could exploit an existing prototype pollution vulnerability within the application code. This could lead to unauthorized remote code execution RCE on the server through a two-step attack involving external...

CVE-2026-14448 Authenticated RCE in system_certificates view

An high privileged remote attacker can exploit an authenticated OS command injection vulnerability in the systemcertificates view due to improper neutralization of special elements in an OS command. This can result in a total loss of confidentiality, availability and integrity...

CVE-2026-14448

CVE-2026-14448 describes an authenticated remote command-injection vulnerability in the system_certificates view. The root cause is improper neutralization of special elements in an OS command, enabling high-privilege attackers to execute arbitrary commands. Impact per sources includes total loss...

CVE-2026-42211

A flaw was found in React Router when operating in Framework Mode. A remote attacker could exploit an existing prototype pollution vulnerability within the application code. This could lead to unauthorized remote code execution RCE on the server through a two-step attack involving external...

Exploit for CVE-2026-63030

CVE-2026-63030: WordPress REST API Batch Route Confusion to SQ...

Exploit for CVE-2026-63030

CVE-2026-63030: WordPress REST API Batch Route Confusion to SQ...

Exploit for CVE-2026-60137

/ / / / / / | |/ / \ / /...

CVE-2026-64061

A flaw was found in the Linux kernel's network file system netfs. This use-after-free vulnerability occurs when the netfsreadgaps function prematurely releases a memory page during network read operations. A remote attacker could exploit this by sending specially crafted network traffic, leading ...

httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc

A flaw was found in Apache HTTP Server, specifically within the modxml2enc module. This heap-based buffer overflow vulnerability can be triggered when processing untrusted content through the xml2StartParse function. A remote attacker could potentially exploit this to cause a denial of service,...

Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager - Remote Code Execution

Cisco Prime Infrastructure PI and Cisco Evolved Programmable Network EPN Manager could allow an authenticated, remote attacker to execute code with root-level privileges on the underlying operating system. This vulnerability exist because the software improperly validates user-supplied input. An...

libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image

A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT8BITABGR output format and a specific stride value, leading to a heap-base...

Important: Red Hat Security Advisory: evince security update

An update for evince is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

Exploit for CVE-2026-63030

CVE-2026-63030 - WordPress REST API Batch Route Confusion PoC...

PT-2026-61735

Name of the Vulnerable Software and Affected Versions GRAPHIFY versions 0.3.2 through 0.4.29 Description A remote attacker can execute arbitrary code through the validate url, safe fetch, build opener, fetch html, and download binary functions. Recommendations At the moment, there is no informati...

CVE-2026-52656

CVE-2026-52656 affects SJCAM AllWinner Tech SJ4000-Air prior to v1.4C and Whitelabel-based prior to v1.4C. The issue allows an attacker to execute arbitrary code via a specially crafted FEX file. Connected sources confirm affected versions and vulnerability class; PT-2026-61058 notes no public fi...