CVE-2026-95675 D-Link DAP-1360 6.14 Unauthenticated RCE via Web Management Interface

D-Link DAP-1360 firmware version 6.14 and earlier contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary commands as root by sending crafted requests to the device's web management interface without valid credentials. Attackers can fully...

wildfly-clustering-faces-mojarra: com.sun.faces:jsf-impl: org.glassfish:jakarta.faces: mojarra: Unauthenticated RCE in EAP JSF applications via EL injection in ui:include

A flaw was found in EAP. Any estate hosting a JSF app using the user-controlled-include pattern would permit EL injection, achieving unauthenticated RCE as the server process user...

Exploit for CVE-2026-90817

CVE-2026-90817 — REDCap Survey Passthru + Data Import RCE Pyt...

CVE-2024-11680

ProjectSend CVE-2024-11680 エクスプロイト これは、ProjectSend における CVE-2024-11680 の概念実証エクスプロイトです。この脆弱性は認証不要の設定変更とウェブシェルのアップロードを可能にします。 説明 このエクスプロイトは ProjectSend の複数の脆弱性を利用します: CSRFトークンのバイパスによる設定変更 安全でないクライアント登録設定 無制限のファイルアップロードによるリモートコード実行 必要条件 Python 3.x 必要な Python パッケージ: root@kitploit: pip install request...

Exploit for OS Command Injection in Webmin

CVE-2019-15107 – Webmin Unauthenticated RCE Lab 1. Project Over...

CVE-2026-90817

An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintended controller route from a public survey context and by...

CVE-2026-90817

CVE-2026-90817 is an unauthenticated Remote Code Execution vulnerability in REDCap 13.3.0 and higher , rated CVSS 9.8 (Critical) . The flaw resides in the survey passthrough routing and Data Import processing logic , where an attacker can manipulate HTTP requests to reach an unintended controller...

SolarWinds Patches ARM Hard-Coded Key Flaw Enabling Unauthenticated RCE

SolarWinds has released security updates to address a high-severity flaw in Access Rights Manager ARM that, if successfully exploited, could lead to an unauthenticated remote code execution vulnerability. The vulnerability, tracked as CVE-2026-28326 , is rated 8.8 out of 10.0 on the CVSS scoring...

Critical Pre-Auth RCE in Orkes Conductor Workflow Platform Exploited in the Wild

A critical vulnerability impacting Orkes Conductor is being actively exploited in the wild, according to Fortinet. The vulnerability in question is CVE-2026-58138 CVSS v3.1 score: 9.8/CVSS v4 score: 9.3, which relates to a case of unauthenticated remote code execution. "Orkes Conductor 3.21.21...

CVE-2026-81657

IBM Guardium Data Protection 12.2 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data...

Exploit for CVE-2026-45140

abraxaslabs.tech · github.com/abraxas ·&...

CVE-2025-66455 LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.2 and prior to version 0.16.0, LMDeploy's PyTorch DistServe/PD-disaggregation control plane used recvpyobj to deserialize messages received through a ZeroMQ PULL socket. PyZMQ implements...

CVE-2026-75031

A critical Remote Code Execution (RCE) vulnerability exists in the interchange/interchange project within the “quick question” admin feature. In default installations, unauthenticated users can inject and execute arbitrary Perl code on the server side. While the code normally runs within a Safe c...

USN-8782-1: Rclone vulnerability

It was discovered that Rclone incorrectly handled unauthenticated requests to the remote control API. An attacker could possibly use this issue to execute arbitrary commands as the user invoking rclone. CVE-2026-49980...

USN-8782-1 rclone vulnerability

It was discovered that Rclone incorrectly handled unauthenticated requests to the remote control API. An attacker could possibly use this issue to execute arbitrary commands as the user invoking rclone. CVE-2026-49980...

VulnCheck KEV: CVE-2026-86124

AutoAgent contains an unauthenticated remote code execution vulnerability in the TCP server that binds to all interfaces and executes attacker-supplied commands as root. Attackers can connect to the exposed communication port and execute arbitrary bash commands within the container, gaining acces...

CVE-2026-54237

Wavelog is web-based amateur radio logging software. From 1.8 until 2.4.2, Wavelog exposes /install/ajax.php and /install/includes/interfaceassets/triggers.php after installation without an installation lock or permission check. Unsanitized input reaches writeconfig and writeconfigfile in...

GHSA-G4C3-4G96-6G4M Chamilo LMS CStudio upload flow allows unauthenticated remote code execution

Impact Ability to run arbitrary code on the server without authentication...

CVE-2026-54237 Wavelog: Unauthenticated Remote Code Execution

Wavelog is web-based amateur radio logging software. From 1.8 until 2.4.2, Wavelog exposes /install/ajax.php and /install/includes/interfaceassets/triggers.php after installation without an installation lock or permission check. Unsanitized input reaches writeconfig and writeconfigfile in...

CVE-2026-45140 Chamilo LMS CStudio upload flow allows unauthenticated remote code execution

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism. This issue is...