Webserver

The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to authenticated SQL injection via the tracking_provider parameter, allowing attackers with Shop Manager privileges to exfiltrate database contents.

Multiple vulnerabilities in Redmine allow remote attackers to perform cross-site scripting (XSS), bypass security policies, or trigger denial-of-service conditions.

Network-AI versions prior to 5.15.5 contain a path traversal vulnerability in InputSanitizer.sanitizePath() that allows attackers to escape the base directory via sibling-directory paths.

Termix-SSH Termix versions up to 2.9.2 are vulnerable to remote path traversal via the destPath argument in the /plugin-api/file-manager/transferToHost endpoint.

Gitea versions 28.2.0 and earlier fail to enforce archival read-only status on milestone, release, and label API routes, allowing write-collaborators to modify or delete sensitive project metadata.

ShowDoc versions 2.8.14 through 3.9.5 are vulnerable to authenticated remote code execution via a code injection flaw in the Mock feature's template processing.

The Popup Builder WordPress plugin contains an authorization bypass vulnerability (CVE-2026-89270) that allows unauthenticated attackers to bulk delete published popups via a crafted GET request.

CallBackery versions prior to 0.60.1 allow unauthenticated remote attackers to read arbitrary file contents via path traversal in the /doc route.

An authorization bypass vulnerability in SUSE Rancher Manager (CVE-2026-104623) allows authenticated users to spawn an unprivileged shell pod in the cattle-system namespace.

An authenticated administrator can exploit a Server-Side Template Injection (SSTI) vulnerability in the Zammad AI Agent feature to achieve remote code execution via the type_enrichment_data configuration.

Traggo server v0.8.3 is vulnerable to an unauthenticated Denial of Service due to a lack of complexity and size limits on the /graphql endpoint, allowing attackers to exhaust CPU and memory resources.

A path traversal vulnerability (CVE-2025-55752) in the Apache Tomcat RewriteValve component allows unauthenticated attackers to bypass security constraints and access protected files like /WEB-INF/web.xml by abusing an improper URL normalization-before-decoding processing order.

Tandoor Recipes versions before 2.7.0 are vulnerable to SSRF in the Pestle importer, allowing authenticated low-privileged users to force server-side GET requests to arbitrary internal or external targets.

Multiple vulnerabilities in WordPress versions prior to 7.1.4 allow remote attackers to execute arbitrary code, conduct denial-of-service, perform unauthorized data access, and bypass security policies.

A vulnerability in Grafana allows a remote, authenticated attacker to bypass security measures and perform unauthorized information disclosure.

A vulnerability in the Kafka Connect configuration validation REST API allows an attacker to exfiltrate sensitive secrets intended to be resolved only at runtime.

Metabase has released security updates for multiple unspecified vulnerabilities affecting Pro, Enterprise, and open-source editions, requiring an upgrade to version 0.64.3.4 or 1.64.3.4.

Qualitor versions 8.20 and earlier are vulnerable to unauthenticated remote code execution via PHP code injection into the gridValoresPopHidden parameter, with public proof-of-concept exploits available.

The Mage Eventpress WordPress plugin is vulnerable to privilege escalation in versions 5.7.8 and earlier due to improper request parameter validation in the mep_grant_shop_manager_access function.

FileBrowser Quantum versions prior to 1.5.2-stable and 2.0.1-beta contain a path-traversal vulnerability that allows authenticated or unauthorized users to read arbitrary server files by exploiting improperly validated symbolic links.

Multiple vulnerabilities in GLPI allow remote attackers to perform SQL injection, cross-site scripting, and security policy bypass, resulting in data integrity loss.

Nextcloud disclosed multiple vulnerabilities across its server platform and various applications, including Tables, Whiteboard, Files Confidential, Collectives, and Richdocuments, which could allow attackers to bypass security controls, manipulate data, or cause Denial-of-Service.

REDAXO core versions 5.3.0 through 5.21.3 contain an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge administrative login tokens and achieve code execution.

Starman versions prior to 0.4019 are susceptible to multiple denial-of-service vectors, including resource exhaustion via stalled request bodies, CPU exhaustion from regex backtracking, and response desynchronization.

Mautic 7 allows authenticated users with campaign import permissions to achieve remote code execution by uploading arbitrary malicious files to a publicly accessible directory.

HTTP::Server::PSGI versions before 1.0056 are susceptible to a remote denial-of-service vulnerability triggered by an excessively large Content-Length header.

An unauthenticated denial of service vulnerability in vLLM versions 0.10.2 through 0.24.x allows attackers to trigger an out-of-memory condition by submitting decompression-bomb images to the /v1/chat/completions endpoint.

A server-side request forgery vulnerability in Zylon PrivateGPT versions 1.0.0 and 1.0.1 allows remote attackers to perform unauthorized requests via the URI Artifact Loader component.

CVE-2025-52691 is a critical arbitrary file upload vulnerability in SmarterMail (Build 9406 and earlier) that enables unauthenticated remote code execution, with multiple proof-of-concept exploits publicly available.

Kruize Autotune contains an authentication bypass in its REST API that exposes sensitive monitoring datasource credentials in cleartext via improperly serialized JSON responses.

Multiple vulnerabilities in HAPI FHIR version 8.10.0 allow for cross-tenant partition override, authorization bypasses, and heap exhaustion via gzip compression, potentially exposing patient data in multi-tenant environments.

The Storybook development server exposes authentication tokens via WebSocket, allowing attackers on the same local network to inject malicious code into story files and execute arbitrary commands through vulnerable addons.

The PHP Group has disclosed multiple vulnerabilities that allow a remote, anonymous attacker to cause a denial-of-service condition, bypass security controls, or achieve other unknown impacts.

PHPOK versions 4.5.000 through 5.4.080 contain an unauthenticated SQL injection vulnerability in the sort parameter of the project index API, enabling error-based database information extraction.

Traefik versions prior to 3.7.14 contain an access-control bypass vulnerability in the Kubernetes Ingress NGINX provider that allows unauthenticated access to backends protected by security annotations.

Apache Traffic Server is vulnerable to request smuggling due to the improper handling of shared origin connections when client request bodies are incomplete, allowing cache poisoning and access control bypass.

LocalAI versions 4.6.0 through 4.11.0 are vulnerable to server-side request forgery (SSRF) allowing attackers to exfiltrate internal metadata via malicious configuration URLs.

OpenChoreo API server allows authenticated users with workflow update permissions to hijack ownership of cross-project WorkflowRuns, leading to unauthorized access to logs, build credentials, and workflow modification.

An unauthenticated remote attacker can trigger a denial-of-service condition by sending specially crafted multipart requests that cause uncontrolled file descriptor allocation in the aiohttp library.

Letta versions through 0.16.8 ship with a insecure compose.yaml that disables authentication middleware and exposes a PostgreSQL database with default credentials, enabling remote code execution and administrative account takeover.

Grav versions 2.0.15 through 2.2.1 contain an allowlist bypass vulnerability allowing authenticated page editors to execute arbitrary public static methods, leading to unauthorized file system operations.

Authenticated users with the task_runner role in Semaphore UI versions up to 2.19.16 can achieve remote code execution by injecting malicious Ansible configuration parameters into task environment payloads.

An unauthenticated arbitrary file read vulnerability (CVE-2025-10952) in the ml-logger stream_handler allows remote attackers to enumerate and exfiltrate sensitive files from the host filesystem.

WeRSS version 1.5.3 and earlier contains a remote code execution vulnerability allowing unauthenticated attackers to bypass eval denylists via template parameters.

FastapiAdmin versions through 3.0 contain an authentication bypass vulnerability allowing unauthenticated attackers to obtain superuser sessions via unprotected auto-login endpoints.

An unauthenticated remote denial-of-service vulnerability in Qwik allows attackers to terminate Node.js server processes by sending a maliciously crafted qwik-json payload, resulting in persistent service outages.

The sar2html 4.0.0 application is vulnerable to remote SQL injection via the 'sort' parameter in sar2html.py, enabling unauthenticated attackers to execute arbitrary database queries.

Stills versions prior to 25.24.2 are vulnerable to OS command injection via crafted media file paths containing shell metacharacters, enabling arbitrary command execution with Node.js process privileges.

Multiple vulnerabilities in Fortinet FortiAnalyzer and FortiManager enable remote, unauthenticated attackers to perform SQL injection attacks, potentially resulting in unauthorized data access.

SourceCodester Online Exam System 1.0 is vulnerable to unauthenticated remote SQL injection via the login endpoint, allowing potential authentication bypass.

CVE-2024-20767 is a critical arbitrary file read vulnerability in Adobe ColdFusion caused by improper access control, allowing unauthenticated attackers to exfiltrate sensitive files from the host server.

An unauthenticated remote attacker can exploit CVE-2026-107805 in Nginx UI by sending malicious requests that trigger premature staging of large, unsigned request bodies, leading to disk space and I/O exhaustion.

Apache CXF is vulnerable to multiple security flaws including security constraint bypass, data manipulation, unauthorized data disclosure, open redirection, and denial-of-service conditions associated with CVE-2024-37554, CVE-2024-38709, and CVE-2024-38710.

Openfind SecuShare Pro is vulnerable to an unauthenticated OS command injection flaw (CVE-2026-107459) allowing remote attackers to execute arbitrary commands on the host server.

An unauthenticated remote attacker can trigger a use-after-free or double-free condition in llama.cpp version b11393 or earlier by sending a malformed POST /completion request to achieve memory corruption.

An unauthenticated arbitrary file upload vulnerability (CVE-2026-81780) in the Hash Form WordPress plugin allows attackers to achieve remote code execution through the 'admin-ajax.php' endpoint.

Langflow versions 1.10.0 and earlier use a non-cryptographic PRNG to derive Fernet keys from short SECRET_KEYs, allowing unauthenticated attackers who obtain the secret key file to perform offline decryption of all stored user credentials.

A vulnerability in Apache Traffic Server (CVE-2024-41754) allows a remote, unauthenticated attacker to bypass security policies, potentially resulting in unauthorized traffic manipulation.

OpenAM versions prior to 16.1.3 are vulnerable to unauthenticated arbitrary class instantiation via the legacy JAX-RPC SOAP interface, enabling potential remote code execution.

Multiple security vulnerabilities in Apache HTTP Server versions prior to 2.4.69 allow for remote code execution, denial of service, and data integrity compromise.

An authentication bypass vulnerability in the YesWiki triples delete API allows authenticated users to delete arbitrary semantic triples, potentially resulting in site-wide denial of service.

An authenticated, low-privileged attacker can achieve remote code execution in Foreman by bypassing the templating engine's safemode sandbox to invoke unauthorized functions.

The AI Engine plugin for WordPress is vulnerable to Stored Cross-Site Scripting, allowing unauthenticated attackers to achieve arbitrary script execution in an administrator's browser session.

A vulnerability in the @astrojs/node adapter, identified as CVE-2026-102984, allows remote attackers to trigger a process crash by sending HTTP requests with malformed Host headers.

Zammad helpdesk software is being actively exploited via two zero-day vulnerabilities, including an unauthenticated RCE (CVE-2026-102489) and an unpatched privilege escalation flaw (CVE-2026-102490).

AiSOC versions 7.2.0 through 11.9.9 are vulnerable to authenticated command injection via unescaped parameters in the actions service, allowing arbitrary command execution with elevated privileges.

Seeyon A6 contains an unauthenticated SQL injection vulnerability in the downloadAtt.jsp endpoint, allowing remote attackers to extract sensitive database contents via the attach_ids parameter.

An unauthenticated remote command injection vulnerability in the aaPanel BaoTa File Merge Handler allows attackers to execute arbitrary system commands via the split_file_path parameter.

AzuraCast versions prior to 0.23.8 are vulnerable to a DQL injection flaw in the sortOrder API parameter, allowing attackers to exfiltrate sensitive database contents.

Hugo versions 0.161.0 through 0.165.0 contain a directory traversal vulnerability where the Node.js sandbox fails to resolve symbolic links correctly, allowing unauthorized disclosure of sensitive files during the build process.

An authentication bypass vulnerability in the Grav CMS Comments plugin through version 1.2.10 allows unauthenticated attackers to exfiltrate comment data, including emails and server paths, via an improperly secured admin handler.

SiYuan versions prior to v3.8.4 are vulnerable to a path traversal attack via the exportBrowserHTML endpoint, allowing authenticated administrators to overwrite arbitrary index.html files.

Froxlor versions through 2.3.10 are vulnerable to arbitrary file deletion where authenticated users can plant symlinks to trigger recursive deletion by a root-privileged cron task, leading to potential data destruction.

A critical HTTP/2 request smuggling vulnerability, CVE-2026-86350, allows unauthenticated attackers to induce dynamic table desynchronization in Apache Tomcat via crafted header blocks.

Zoraxy versions 3.2.3 through 3.3.4 contain a vulnerability in IPv6 address parsing that allows unauthenticated attackers to spoof the X-Forwarded-For header and bypass IP-based access controls.

The X-SpringBoot application up to version 6.0 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve login verification codes and hijack user accounts.

IBM Enterprise Build of Quarkus versions 3.27.1 through 3.27.5.SP1 and 3.33.1 through 3.33.3.SP1 are vulnerable to unauthenticated SQL injection, allowing attackers to access or modify back-end database content.

Halo versions 2.25.4/2.26.1 and prior contain a critical vulnerability in the SpEL Handler component, allowing remote unauthenticated attackers to achieve remote code execution through improper expression neutralization.

A critical unauthenticated RCE vulnerability (CVE-2026-90817) in Vanderbilt REDCap allows attackers to bypass routing restrictions through the '__passthru' parameter, enabling unauthorized access to administrative controllers.

9router versions <= 0.4.80 contain an authentication bypass vulnerability where traffic from a local reverse proxy is incorrectly trusted as local loopback, allowing unauthenticated access to restricted /v1/ APIs.

IBM Concert versions 1.0.0 through 3.0.0 contain an access control vulnerability due to wildcard usage in RBAC permissions that allows authenticated attackers to access or modify unauthorized resources.

Sync-in Server v2.3.0 and earlier is vulnerable to a 2FA bypass in the /api/auth/token endpoint, allowing attackers with known credentials to obtain unrestricted JWTs without providing TOTP codes.

An unauthenticated time-of-check to time-of-use (TOCTOU) race condition in the nginx-ignition onboarding API allows remote attackers to create administrative accounts on fresh or reset instances.

The Semantic MediaWiki smwtask API module fails to enforce authorization, enabling unauthenticated remote attackers to perform sensitive information disclosure, queue administrative maintenance jobs, and manipulate stored semantic data.

IBM Cloud Pak for Data 5.1.2 is vulnerable to a path traversal vulnerability via crafted URL requests that allow unauthenticated remote attackers to access arbitrary files on the system.

A vulnerability in Eclipse Jetty, identified as CVE-2024-8184, allows a remote unauthenticated attacker to manipulate displayed information and gain unauthorized access to sensitive data.

A vulnerability in Varnish HTTP Cache allows a remote, unauthenticated attacker to trigger a denial of service condition, potentially causing service instability or resource exhaustion.

Nango versions through 0.70.4 are vulnerable to Server-Side Request Forgery due to improper validation of user-supplied configuration values in token and proxy URL templates.

Uber Kraken versions 0.1.29 and earlier contain a path traversal vulnerability in the /tags/{tag} endpoint, allowing unauthenticated attackers to read arbitrary files from the filesystem.

SigNoz versions 0.88.0 through 0.141.0 contain an authorization bypass vulnerability allowing unauthenticated remote attackers to query sensitive trace analytics via the trace-funnel endpoint.

A vulnerability in F5 NGINX, tracked as CVE-2026-90439, allows remote attackers to trigger a denial of service and potentially compromise data integrity.

An authenticated high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint to execute arbitrary code with root privileges.

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files endpoint to achieve arbitrary code execution with root privileges.

An authentication bypass vulnerability in lamp-cloud versions 5.10.0 and earlier allows unauthenticated attackers to exfiltrate sensitive JVM system properties via insecurely whitelisted API endpoints.

An unauthenticated remote code execution vulnerability in Cheshire Cat AI version 1.9.2 and earlier stems from improper validation of the user_id argument within the custom authentication handler.

Spug versions 3.4.0 and earlier are vulnerable to authenticated remote code execution due to improper shell command validation in the ping_check function.

CAPEv2 versions up to commit 471ee4b contain an IDOR vulnerability allowing authenticated users to access and delete arbitrary analysis tasks.

Orion-visor versions 2.5.7 and earlier contain a hard-coded cryptographic key within the HostKeyServiceImpl.encryptKey function, enabling potential remote compromise of encrypted host keys.

Mockoon versions before 9.7.0 expose an unauthenticated, CORS-misconfigured admin API by default, allowing attackers to exfiltrate environment variables, hijack mock responses, and perform cross-origin secret theft.

Multiple vulnerabilities in GitLab allow remote attackers to achieve arbitrary code execution, escalate privileges, bypass security controls, and perform other malicious actions.

The mistralrs-server-core component allows unauthenticated attackers to perform SSRF and enumerate local files via unvalidated image_url and audio_url message parameters.

Traefik fails to isolate connection-bound NTLM and Negotiate authentication on HTTP/3 routes, allowing unrelated clients to inherit victim-authenticated backend connections.

An unauthenticated credential access vulnerability in n8n allows users to bypass domain restrictions in the OpenAI Chat Model node via the model-search endpoint, leading to unauthorized credential exposure.

A vulnerability in Fortinet FortiSIEM allows a remote, unauthenticated attacker to perform an open redirect, enabling the redirection of users to malicious or untrusted websites.

The Eventin WordPress plugin contains a local file inclusion vulnerability in the event_layout parameter, allowing authenticated contributors to execute arbitrary PHP code.

A critical remote code execution vulnerability (CVE-2025-24813) in Apache Tomcat with a CVSS score of 10.0 is now being targeted by publicly available proof-of-concept exploit tools.

The PayTR Virtual Pos iFrame API (v9x) WHMCS Module, versions 9.0.0 through 9.0.2, is vulnerable to input data manipulation due to improper quantity validation, allowing potential unauthorized modification of transaction parameters.

Authenticated remote attackers can exploit vulnerabilities in SmarterTools SmarterMail to bypass path restrictions, access unauthorized files, and compromise administrative API functions or cached credentials.

The surya screenshot server version 0.22.1 is vulnerable to an unauthenticated arbitrary file read vulnerability via the /info, /page, and /process routes, allowing attackers to access sensitive local files.

Xinference versions 3.x and commit 4a94832 contain an unauthenticated arbitrary file read vulnerability via the model_path parameter in the auto-register endpoint.

TEN Framework version 0.11.71 contains unauthenticated file read and write vulnerabilities in its API endpoints, enabling remote code execution via file system manipulation.

The xiaobei product through version 5.5.2 lacks authentication on webhook endpoints, enabling unauthenticated remote code execution via pipeline message injection and server-side request forgery (SSRF) via malicious media URL fetching.

An information disclosure vulnerability in SiYuan's API allows unauthorized remote readers to retrieve cryptographic material necessary for offline, unthrottled GPU-based cracking of encrypted notebook master passwords.

An improper access control vulnerability in Omnigent allows authenticated users to overwrite shared agent bundles, enabling arbitrary command execution on runner infrastructure via malicious MCP server configuration.

ApostropheCMS versions 4.32.0 and earlier are vulnerable to a prototype pollution vulnerability that allows an authenticated attacker to trigger a persistent Denial of Service (DoS) by overwriting the global toString function.

Sangoma Switchvox is vulnerable to an unauthenticated SQL injection flaw that allows remote attackers to execute arbitrary SQL commands on the backend PostgreSQL database, potentially leading to remote code execution.

The DevKit Pro plugin for WordPress versions 2.3.0 and earlier contains an authorization vulnerability that allows authenticated attackers to perform remote code execution via arbitrary theme installation.

Casdoor versions up to 4.0.0 contain an authentication bypass vulnerability in the upload-resource API that permits remote, unauthenticated file operations.

D-Link DNS-340L and DNS-345 network storage devices are susceptible to remote OS command injection via the /cgi-bin/virtual_vol.cgi component, enabling unauthenticated remote code execution.

A vulnerability in the Undertow web server used in JBoss EAP and WildFly allows remote attackers to trigger denial of service through WebSocket resource exhaustion due to unconfigurable limits.

ToolJet versions prior to 3.16.208 are vulnerable to broken access control, allowing authenticated builder-role users to perform unauthorized database operations across tenant boundaries.

SeaCMS versions 13.6 and earlier contain a code injection vulnerability in the search.php file, allowing remote attackers to execute arbitrary code via the searchtype parameter.

WWBN AVideo is vulnerable to a Server-Side Request Forgery (SSRF) bypass in the isSSRFSafeURL function due to improper normalization of hex-encoded NAT64 addresses.

OpenSAGRES XDocReport is vulnerable to a critical server-side template injection (SSTI) flaw via the Apache Velocity engine, allowing unauthenticated remote code execution through malicious .docx uploads.

MapFish Print is susceptible to an XML External Entity (XXE) injection vulnerability via the GML layer processing feature, allowing attackers to perform arbitrary file reads or Server-Side Request Forgery (SSRF).

IBM Langflow OSS versions 1.0.0 through 1.11.1 contain an unauthenticated remote code execution vulnerability in the A2A public endpoint.

An unauthenticated remote denial-of-service vulnerability in alos-http allows attackers to crash the server process by sending a single malformed HTTP request starting with a '?' character.

An unauthenticated path traversal vulnerability in DB-GPT allows remote attackers to write arbitrary files and achieve remote code execution by uploading malicious Python modules to the application server.

An unrestricted file upload vulnerability (CVE-2026-16286) in TRtek Software Repository Management enables unauthenticated attackers to upload web shells, leading to complete remote system compromise.

An unauthenticated SQL injection vulnerability in the PlanController.getImmediatePlans function of the Shenzhen Gongji Technology XBROTHER Dynamic Environment Monitoring System allows remote attackers to execute arbitrary SQL commands.

The PPWP WordPress plugin contains a PHP Object Injection vulnerability in the post_protection_roles parameter, allowing authenticated attackers to achieve remote code execution if a compatible POP chain exists in the environment.

An authentication bypass vulnerability in AVideo (CVE-2026-59808) allows attackers with upload access to hijack administrative sessions via improper video ownership verification.

Vouch Proxy contains an unauthenticated heap-allocation vulnerability in its multipart cookie reassembly logic that allows remote attackers to crash the service via a crafted HTTP cookie.

Pipelines-as-Code (CVE-2026-54167) is vulnerable to GitHub App JWT exfiltration because it incorrectly trusts the 'X-GitHub-Enterprise-Host' header to define the API endpoint before validating incoming webhook signatures.

An SSRF vulnerability in the AWX webhook status callback mechanism allows attackers with template-level administrative access to exfiltrate Git Personal Access Tokens via forged webhook payloads.

Remote attackers can exploit multiple vulnerabilities in Icinga Web to conduct Denial of Service attacks or disclose sensitive information due to improper request handling.

ArcadeDB versions before 26.8.1 contain a vulnerability in the gRPC transaction executor that allows authenticated readers to execute arbitrary JavaScript, leading to server-wide privilege escalation.

An improper redirect URI validation vulnerability in Medplum allows attackers to steal authorization codes and perform account takeover by prefix-matching registered callback URIs.

An unauthenticated-accessible prototype pollution vulnerability in the Trigger.dev metadata API allows low-privileged attackers to corrupt the global object, leading to cross-tenant denial of service and process crashes via CVE-2026-73654.

Budibase versions before 3.40.0 are vulnerable to path traversal via maliciously crafted S3 object keys, allowing authenticated builders to perform arbitrary file writes during workspace export.

GitLab contains multiple security vulnerabilities that allow attackers to perform cross-site scripting, bypass security constraints, escalate privileges, disclose sensitive information, or trigger denial-of-service conditions.

Weaver E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLoad servlet that allows unauthenticated remote attackers to read arbitrary files via the markId parameter.

A command injection vulnerability in the mcp-bridge.js component of mcp-bridge-api allows remote attackers to execute arbitrary system commands via manipulation of the command/args argument.

Weaver E-cology 9.0 versions prior to 10.52 are vulnerable to unauthenticated arbitrary file upload via the /workrelate/plan/util/uploaderOperate.jsp endpoint, allowing remote code execution.

Ground Station versions prior to 0.6.0 are susceptible to an unauthenticated denial-of-service vulnerability in the Socket.IO service_control event handler, allowing remote attackers to terminate critical satellite-tracking processes via a restart_service command.

Multiple critical vulnerabilities in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources version 26.0 allow unauthorized access, web shell upload, session hijacking, and remote code execution. Upgrade to version 26.1 immediately.

ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer component that allows authenticated attackers to execute arbitrary commands as the webconfig user, with subsequent escalation to root.

The undici library is susceptible to cache poisoning leading to information disclosure and application crashes due to improper handling of malformed Cache-Control directives in the cache interceptor.

A critical SQL injection vulnerability in NocoBase allows authenticated attackers to achieve remote code execution on the underlying PostgreSQL container via stacked statements.

IBM WebSphere Application Server and Liberty are vulnerable to unauthenticated Server-Side Request Forgery (SSRF) when the SIP container feature is enabled, allowing attackers to perform unauthorized requests to internal services.

An unauthenticated attacker can exploit a Stored Cross-Site Scripting vulnerability (CVE-2026-16655) in the Fluent Forms WordPress plugin, versions up to and including 6.2.7, via insufficient input sanitization of the Name Field Nested `password` Member, allowing injection of arbitrary web scripts that execute in a user's browser upon page access.

An unauthenticated path traversal vulnerability (CVE-2026-54650) in openhole-server and openhole CLI versions 0.1.1 and earlier allows remote attackers to read arbitrary files outside the web root on tunneled local services by exploiting URL-decoded percent-encoded dot-segments and slashes, enabling arbitrary file disclosure and potential bypass of access controls.

An unauthenticated attacker can exploit CVE-2026-54719 in goshs versions up to 1.1.4 and goshs/v2 up to 2.1.0 to bypass file-based Access Control Lists (ACLs) and read any file under the webroot using the `?bulk` zip-download route, leading to unauthorized information disclosure.

A path traversal vulnerability, tracked as CVE-2026-67185, exists in TinyWeb through version 0.0.8, allowing unauthenticated attackers to read arbitrary files by submitting '..' sequences in the URL path, bypassing security checks and potentially exposing sensitive data like credential stores or private keys when the server runs with root privileges.

A critical memory leak vulnerability, CVE-2026-67183, in TinyWeb versions up to 0.0.8 allows unauthenticated attackers to exhaust server memory by sending ordinary HTTP requests, leading to worker process termination and denial of service.

A critical HTTP request smuggling vulnerability (CVE-2026-66752) exists in tiny-http versions up to and including 0.12.0, allowing remote attackers to desynchronize request framing by sending a Transfer-Encoding header with arbitrary values, causing the library to incorrectly apply chunk-decoding and ignore Content-Length, which enables request smuggling attacks and can lead to denial of service by tying up connections and consuming worker threads.

An unauthenticated Slowloris denial of service vulnerability exists in the default `serve()` path of AWS's `aws-smithy-http-server` framework (versions <= 0.66.4), allowing remote attackers to exhaust server resources by initiating numerous incomplete connections.

A vulnerability in `http4s-blaze-server` allows an attacker to cause a denial of service by exploiting unbounded WebSocket message aggregation, enabling an attacker to drive unbounded heap growth in the server's JVM by sending an unterminated fragmented WebSocket message, leading to an `OutOfMemoryError` and server termination, affecting any http4s application serving WebSocket routes over `BlazeServerBuilder` and triggerable by unauthenticated or authenticated clients.

An unauthenticated remote code execution vulnerability, tracked as CVE-2026-62379, affects OpenAM up to and including version 16.1.1, allowing attackers to achieve full server compromise by sending a crafted XML element to the `/authservice` endpoint that names and instantiates an arbitrary Java class without validation on default configurations.

The @fastify/static package is vulnerable to a route guard bypass via path traversal using non-leading '..' or '%2E%2E' path segments, allowing attackers to circumvent route-based middleware and access protected files that are served by the static plugin.

An unauthenticated path traversal vulnerability (CVE-2026-65694) in the static file controller of Microweber CMS, affecting versions through 2.0.20, allows remote attackers to read arbitrary files by supplying directory traversal sequences in the 'path' query parameter via a single unauthenticated HTTP GET request, potentially disclosing sensitive information like environment configuration files containing credentials or system files.

A critical vulnerability chain, CVE-2026-63732, in 9router version 0.4.59 allows a remote, unauthenticated attacker to achieve arbitrary code execution on the host operating system by leveraging a hardcoded default password for initial access, bypassing a local-only network restriction via Host header spoofing, and exploiting unvalidated arguments during MCP plugin registration to execute malicious code when a plugin's SSE endpoint is triggered.

An authorization bypass vulnerability, CVE-2026-15015, in all versions up to 1.6.1 of the MountDev AI MCP Connector for WordPress plugin allows unauthenticated attackers to obtain an administrator-bound OAuth Bearer token by exploiting publicly accessible client registration and an unprotected authorization endpoint, granting full administrator-equivalent access to the plugin's tool surface and WordPress content.

A memory leak vulnerability, CVE-2024-7708, in Eclipse Jetty's server handling of HTTP 100-Continue requests can be exploited by an attacker to trigger an OutOfMemory error, leading to a Denial of Service state for affected servers.

A denial of service vulnerability (CVE-2026-61666) exists in the websocket-driver-ruby library when used to implement a WebSocket server via `WebSocket::Driver.server()`, allowing a remote attacker to send a malformed `Host` header causing a `URI::InvalidURIError` exception and subsequent server process crash if unhandled.

A critical privilege escalation vulnerability, CVE-2026-65049, in the Ninja Forms plugin (version 3.14.8 and prior) for WordPress Multisite allows a subsite Administrator to trigger network-wide deletion of all Ninja Forms data by exploiting an incorrect authorization check combined with unsafe multisite migration defaults, leading to severe data loss.

A high-severity unrestricted file upload vulnerability (CVE-2026-16327) in D-Link DNS-320 firmware version 1.0.2 allows remote attackers to upload arbitrary files, potentially leading to remote code execution and full device compromise, with exploit code publicly disclosed.

An authenticated attacker can exploit a Server-Side Request Forgery (SSRF) vulnerability, CVE-2026-63731, in HyperDX before version 2.31.0 by manipulating the `host` parameter of the ClickHouse proxy test endpoint, leading to disclosure of internal service response bodies and potential access to internal APIs, container services, and cloud provider metadata.

SurrealDB versions prior to 3.1.0 are vulnerable to a session hijacking flaw (CVE-2026-63757) where unauthenticated attackers can enumerate session UUIDs via the HTTP /rpc sessions method and impersonate authenticated sessions to read, write, and delete data, leading to privilege escalation.

This detection rule identifies suspicious child process executions originating from web server processes on Linux systems, indicating that attackers may have exploited web application vulnerabilities such as command injection or remote file inclusion to establish persistence or execute malicious commands.

This brief describes how attackers exploit vulnerabilities in web applications to execute suspicious shell commands via web server processes on Linux, enabling persistence, discovery, credential access, and reverse shell establishment, which can lead to full system compromise and data exfiltration.

A server-side request forgery (SSRF) vulnerability, identified as CVE-2026-16128, exists in zevorn rt-claw versions up to and including 0.2.0. The flaw is located within the `receiver_thread` function of the `http_request` component in `claw/services/swarm/swarm.c`. This critical vulnerability allows remote attackers to perform server-side request forgery, and a public exploit is available, increasing the urgency for detection and mitigation efforts.

The Bricksforge plugin for WordPress, in versions up to and including 3.1.8.6, contains a critical privilege escalation vulnerability, CVE-2026-14956, allowing unauthenticated attackers to register new administrator accounts by manipulating the 'fieldIds' parameter in Pro Forms registration actions, leading to full compromise of the WordPress site.

A vulnerability has been discovered in Traefik versions 3.7.x prior to 3.7.8, enabling an attacker to bypass security policies, potentially leading to unauthorized access or actions.

An injection vulnerability exists in the NGINX Ingress Controller when configured with Custom Resource Definitions (CRDs) or Ingress annotations. An authenticated attacker with write permissions to these CRDs or annotations via the Kubernetes API can craft values to inject arbitrary NGINX configuration directives. This can lead to creating or deleting files and disabling services, affecting the control plane without exposing the data plane.

A heap buffer overflow vulnerability, CVE-2026-42533, exists in NGINX Plus and NGINX Open Source when a 'map' directive uses regex matching and references its capture variables before the map's output variable or uses a non-cacheable variable under certain conditions, allowing an unauthenticated attacker to send crafted HTTP requests causing denial-of-service or remote code execution.

A critical SQL Injection vulnerability, identified as CVE-2026-15300, was found in the GEO my WP plugin for WordPress, affecting versions up to and including 4.5.4, allowing attackers to inject SQL payloads through the 'distance', 'lat', and 'lng' parameters, leading to potential data compromise or denial of service.

An unauthenticated attacker can exploit CVE-2026-15282, an arbitrary file upload vulnerability due to missing file type validation in the `insapp_upload_image_as_attachment` function of the WordPress Instant Appointment plugin up to version 1.2, to upload malicious files and achieve remote code execution on the affected server.

A Cross-Site Request Forgery (CSRF) vulnerability in Cotonti Siena versions 0.9.26 and earlier allows unauthenticated attackers to modify administrator configuration by tricking a logged-in administrator into submitting a forged POST request, enabling the upload and execution of arbitrary PHP files leading to remote code execution.

Cesanta Mongoose before version 7.22 contains an out-of-bounds read vulnerability (CVE-2026-11404) in its built-in TLS server function, `mg_tls_server_recv_hello()`, allowing a remote, unauthenticated attacker to send a specially crafted TLS ClientHello message with an oversized session ID length, leading to a service crash and denial of service for HTTPS, MQTTS, or WSS services.

A critical SQL injection vulnerability (CVE-2026-5955) in Inrove Software and Internet Services BiEticaret, affecting versions before v3.3.57, allows unauthenticated attackers to execute arbitrary SQL commands, potentially leading to data exfiltration and full system compromise.

The Connect Contact Form 7 and Mailchimp plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization. This vulnerability, affecting versions up to and including 0.9.78.06, allows unauthenticated attackers to inject arbitrary web scripts into pages. These scripts execute when a privileged user (Administrator) performs a Contact Lookup on an email address submitted via a CF7 form, indicating a deferred execution model. Detection engineers should focus on monitoring for unusual script injections in forms and administrator interactions with plugin data.

A critical SQL injection vulnerability (CVE-2026-15137) has been identified in code-projects Interview Management System version 1.0, allowing remote unauthenticated attackers to manipulate the 'ID' argument in the '/inc/classes/View.php' file, leading to arbitrary SQL query execution and potential data compromise; a public exploit is available.

CVE-2026-60102 describes an OS command injection vulnerability in the Horde Virtual File System (VFS) API before version 3.0.1, specifically within the Horde_Vfs_Smb driver, which allows authenticated attackers to inject arbitrary shell commands via user-controlled filenames during file operations, leading to arbitrary command execution on the underlying system.

An unauthenticated server-side request forgery (SSRF) vulnerability, CVE-2026-59702, in repomix's POST /api/pack endpoint allows attackers to make arbitrary outbound requests, potentially leading to internal network reconnaissance, access to cloud metadata services, and local filesystem path enumeration.

A critical integer overflow vulnerability, CVE-2021-40346, in HAProxy's `htx_add_header()` function allows unauthenticated attackers to bypass access control rules by crafting HTTP requests with specific header name lengths, leading to HTTP request smuggling and unauthorized access to backend paths, for which a public exploit is available.

CVE-2026-56226 details a high-severity vulnerability in Capgo versions prior to 12.128.2 that exposes a Supabase PostgREST RPC function, `public.get_orgs_v6`, to unauthenticated attackers, allowing them to retrieve sensitive user organization membership and PII by supplying an arbitrary user UUID.

An improper input validation vulnerability (CVE-2026-5356) in the LatePoint - Calendar Booking Plugin for Appointments and Events for WordPress, versions up to and including 5.4.0, allows unauthenticated attackers to exploit its Stripe Connect payment processor by supplying a previously succeeded PaymentIntent ID, resulting in the processing of arbitrary payments.

An unauthenticated attacker can exploit CVE-2026-6230, a time-based blind SQL Injection vulnerability in the Tainacan plugin for WordPress (versions up to and including 1.0.3) via the 'geoquery' parameter, to append arbitrary SQL queries and exfiltrate sensitive information from the database due to insufficient input validation.

An authorization bypass vulnerability (CVE-2026-59708) in Ghostfolio's GET /api/v1/public/:accessId/portfolio endpoint allows unauthenticated attackers with a private access ID to retrieve sensitive financial portfolio data, including holdings and performance metrics, due to missing `granteeUserId` filtering validation.

Vtiger CRM versions up to and including 8.4.0 are vulnerable to authenticated remote code execution (CVE-2026-23698), allowing administrator-level attackers to upload malicious PHP web shells via the ModuleManager import function, bypassing authentication and leading to persistent system compromise.

Multiple vulnerabilities, including CVE-2026-12352 (incorrect authorization) and CVE-2026-12948 (stored cross-site scripting), affect Digi International PortServer TS, Digi One SP, Digi One SP IA, and Digi One IA devices with firmware prior to 2025, allowing unauthenticated bypass, access to restricted resources, credential acquisition, and client-side script execution in critical infrastructure environments.

An arbitrary file write vulnerability (CVE-2026-6101) exists in the AMP for WP – Accelerated Mobile Pages plugin for WordPress, affecting versions up to and including 1.1.12. This flaw, caused by unsafe ZIP file extraction and inadequate cleanup, allows authenticated attackers with Author-level access and administrator-granted permissions to write arbitrary files to web-accessible server locations, potentially leading to remote code execution.

A remote, unauthenticated attacker can exploit a vulnerability in the 'perl-HTTP-Daemon' component within Red Hat Enterprise Linux to execute arbitrary program code with the privileges of the affected service, potentially gaining control over the compromised system.

An authenticated remote attacker can exploit multiple vulnerabilities in Eclipse Jetty to achieve arbitrary code execution, bypass security measures, or perform an HTTP cache poisoning attack, necessitating immediate patching and enhanced monitoring of Jetty instances.

An unauthenticated attacker can remotely exploit CVE-2026-14764, an SQL injection vulnerability in code-projects Hotel and Tourism Reservation 1.0's `/admin/add_event.php` component via the `fdetails` argument, to manipulate database queries and compromise sensitive data, with public exploit disclosure increasing the risk of active exploitation.

A high-severity SQL injection vulnerability (CVE-2026-14746) exists in code-projects Real State Services 1.0, specifically in the `/addprojectrent.php` file, where the `amen` argument can be manipulated to execute arbitrary SQL commands, enabling remote attackers to achieve unauthorized data access or modification, with public exploit disclosure increasing the risk of active exploitation.

A high-severity remote SQL injection vulnerability (CVE-2026-14743) in code-projects Real State Services 1.0 allows an unauthenticated attacker to manipulate the 'loc' argument in the `/normalHomeSale.php` file, leading to arbitrary SQL command execution and potential compromise of confidentiality, integrity, and availability of data, with an exploit publicly available.

A critical unrestricted file upload vulnerability, CVE-2026-14736, in Ruijie RG-UAC up to version 1.0-R1.8.2.p5 allows unauthenticated remote attackers to upload arbitrary files via manipulation of the `upload_image` argument in `user_auth_commit.php`, potentially leading to remote code execution.

A high-severity SQL injection vulnerability, CVE-2026-14688, exists in itsourcecode Online Hotel Management System 1.0 within the `/admin/login.php` file via the `email` argument, allowing remote unauthenticated attackers to bypass authentication and potentially exfiltrate data, with a publicly available exploit.

A high-severity SQL injection vulnerability, identified as CVE-2026-14648, exists in the code-projects Online Voting System up to versions 0.x/1.0, allowing remote unauthenticated attackers to bypass authentication and execute arbitrary SQL commands by manipulating `adminUserName` or `adminPassword` parameters in the `/authentication.php` login component, with public exploit details increasing the risk of active exploitation.

A high-severity authentication bypass vulnerability (CVE-2026-14622) exists in the jairiidriss restaurant-website-php-mysql web application's AJAX Endpoint, specifically affecting the /admin/ajax_files component, allowing remote unauthenticated attackers to gain unauthorized access to sensitive functionalities, with public exploit code increasing immediate risk.

Attackers are actively exploiting Server-Side Request Forgery (SSRF) vulnerabilities in public-facing web applications to access cloud instance metadata services, such as those on AWS, GCP, and Azure, to harvest temporary credentials and sensitive instance details.

A reflected Cross-Site Scripting (XSS) vulnerability, CVE-2026-39379, exists in GeoNetwork due to client-side template injection within error pages, allowing an attacker to craft a URL that, when visited by a victim, causes arbitrary JavaScript to execute in their browser in the context of their authenticated session.

A vulnerability (CVE-2026-50138) in `goshs` versions up to `v2.0.9` allows an authenticated attacker to bypass intended access restriction flags like `--read-only`, `--upload-only`, and `--no-delete` when the WebDAV listener is enabled, leading to unauthorized file creation, modification, deletion, and content exfiltration on the server, compromising data integrity and confidentiality.

A high-severity vulnerability (CVE-2026-50282) in Craft CMS allows an authenticated user to delete destination folders and their contents without explicit delete permissions during a forced folder move operation, enabling asset loss, breaking existing asset references, and causing operational disruption.

A high-severity vulnerability, CVE-2026-50200, in the Steeltoe `Sanitizer` component of the Environment actuator allows for the unintended disclosure of sensitive connection string values, including embedded plaintext credentials, when the `/actuator/env` endpoint is accessed, enabling direct database connection and bypassing application-tier security.

Algernon, when running on a Windows host, is vulnerable to CVE-2026-52792, allowing an unauthenticated attacker to exploit its `filepath.Ext()` processing to bypass script execution and obtain the raw source code of server-side scripts by appending NTFS-equivalent suffixes (such as `::$DATA`, trailing dot, or trailing space) to the URL, thereby leaking sensitive embedded secrets like database credentials, API keys, and `SetCookieSecret` values, which can lead to authentication bypass.

A low-privilege user with a freshly-provisioned SSO account in Netflix's Lemur certificate management service (versions <= 1.9.0) can exploit a Server-Side Request Forgery (SSRF) vulnerability in the ACME authority creation endpoint to reach the AWS EC2 Instance Metadata Service (IMDS), exfiltrating AWS STS credentials, and leveraging a creator-equality Insecure Direct Object Reference (IDOR) vulnerability for permanent access to PKI private keys, resulting in AWS IAM compromise and persistent certificate access.

A critical pre-authentication path traversal vulnerability, CVE-2026-53519, in Nezha Monitoring's dashboard allows an unauthenticated attacker to read arbitrary files from the server's working directory, leading to the exfiltration of the `jwt_secret_key` and full administrative account takeover.

The Divi Form Builder plugin for WordPress, in versions up to and including 5.1.8, is vulnerable to arbitrary file upload leading to remote code execution due to insufficient file extension validation where user-supplied input is interpolated into a regular expression, allowing unauthenticated attackers to bypass .htaccess protections with specific PHP-executable extensions and upload malicious PHP files to the /wp-content/uploads/de_fb_uploads/ directory for remote execution, particularly on Nginx-based servers where .htaccess is ineffective.

An authentication bypass vulnerability (CVE-2026-12415) in the Invoice Generator plugin for WordPress (versions up to and including 1.0.0) allows unauthenticated attackers to perform privilege escalation by modifying the email address of any user, including administrators, and subsequently gaining full account control via a password reset.

A Server-Side Request Forgery (SSRF) vulnerability exists in Hugo versions 0.162.0 through 0.163.0, where the 'security.http.urls' policy designed to deny requests to loopback, internal, and cloud-metadata IPv4 literals could be bypassed as the policy only matched dotted-decimal notation, allowing alternate IPv4 encodings (integer, hex, octal) to pass, enabling build-time server-side requests to internal services and cloud-metadata endpoints when untrusted or data-derived URLs are passed to 'resources.GetRemote'.

An unauthenticated attacker can exploit CVE-2026-55882 in Tilt HUD server versions 0.19.5 through 0.37.3, when exposed on a non-loopback address, by accessing the `/debug/pprof` endpoints to read sensitive process memory, including session and API server tokens, and to degrade application performance through prolonged CPU profiling or tracing.

An integer overflow vulnerability (CVE-2026-55203) in HAProxy through version 3.4.0 allows malicious FastCGI backends to desynchronize the FCGI framing parser, leading to request routing errors, response smuggling, or memory safety issues.

An authenticated user can exploit CVE-2026-54005, a high-severity missing authorization vulnerability in Kirby CMS versions <= 4.9.3 and from 5.0.0-alpha.1 to <= 5.4.3, via the `/api/site/find` REST API route to bypass `pages.access` permissions and retrieve sensitive content and metadata from unauthorized pages.

A critical unauthenticated Remote Code Execution (RCE) vulnerability (CVE-2026-48519) exists in Langflow versions up to and including 1.9.1, allowing attackers to execute arbitrary Python code by sending a crafted JSON payload to the `/api/v1/build_public_tmp` API endpoint of a publicly shared flow.

Authenticated attackers with administrator-level privileges can exploit an arbitrary file upload vulnerability (CVE-2026-7537) in the MDJM Event Management plugin for WordPress (versions <= 1.7.8.3) via the `mdjm_send_comm_email` function due to lack of file validation, enabling remote code execution.

This rule detects unusual child process executions originating from web server processes on Linux systems, which attackers may use to maintain persistence on a compromised system by exploiting web server vulnerabilities.

nextlevelbuilder GoClaw up to 3.11.3 is vulnerable to remote OS command injection via manipulation of the write_file Tool component's FsBridge.WriteFile function (CVE-2026-10219), with a public exploit available.

Gotenberg is vulnerable to a remote denial-of-service (DoS) in multipart `downloadFrom` handling, where a crafted multipart request with multiple `downloadFrom` entries causes concurrent goroutines to write to shared maps without synchronization, leading to process termination.

IBM InfoSphere Optim Test Data Fabrication versions 1.0.0 through 1.0.2.7 are susceptible to a path traversal vulnerability (CVE-2026-3366), allowing a remote attacker to send a specially crafted URL request containing 'dot dot' sequences (/../) to view arbitrary files on the system.

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to enforce request body size limits on plugin HTTP endpoints, allowing an attacker to cause a denial of service via crafted oversized HTTP requests.

A vulnerability in Nginx allows a remote attacker to execute arbitrary code and cause a denial-of-service condition, affecting Nginx Open Source versions 1.x before 1.30.2, versions after 1.31.0 before 1.31.1, Nginx Plus versions 37.x before 37.0.1.1, and versions Rx before R36 P5 or R32 P7.

A remote, anonymous attacker can exploit a vulnerability in cPanel cPanel/WHM to potentially execute arbitrary code or cause a denial-of-service condition.

The BookingPress Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'bookingpress_validate_submitted_booking_form_func' function in versions up to 5.6, allowing unauthenticated attackers to upload arbitrary files and potentially achieve remote code execution if a signature custom field is added to the booking form.

Multiple vulnerabilities in NGINX Open Source and NGINX Plus allow a remote, anonymous attacker to bypass security measures, execute arbitrary code, manipulate data, disclose confidential information, or cause a denial-of-service condition.

Nordex N149/4.0-4.5 Wind Turbine Web Server 4.0 is vulnerable to SQL injection (CVE-2018-25333), allowing unauthenticated attackers to execute arbitrary SQL queries and extract sensitive information via crafted POST requests to login.php.

AVideo is vulnerable to OS command injection (CVE-2026-45578) in the `on_publish.php` file due to improper sanitization of the m3u8 URL, allowing attackers to execute arbitrary commands by injecting shell metacharacters.

NGINX Plus and NGINX Open Source are vulnerable to a heap buffer overflow (CVE-2026-42945) due to crafted HTTP requests when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed PCRE capture with a replacement string that includes a question mark, potentially leading to denial of service or code execution.

SPIP versions prior to 4.4.14 contain a remote code execution vulnerability exploitable in certain Nginx configurations, allowing attackers to execute arbitrary code within the web server's context.

A remote, authenticated attacker can exploit a vulnerability in JetBrains TeamCity On-Premises to escalate privileges.

Multiple vulnerabilities in SmarterTools SmarterMail could allow an attacker to gain elevated privileges, bypass security measures, manipulate data, disclose sensitive information, cause a denial-of-service condition, or carry out other unspecified attacks.

OpenCart 3.0.3.8 is vulnerable to session fixation (CVE-2021-47923), allowing attackers to hijack user sessions by injecting arbitrary values into the OCSESSID cookie, leading to unauthorized access.

A vulnerability in Apache HTTP Server's HTTP/2 protocol can lead to denial of service by crashing worker processes, and in specific configurations (APR with mmap), remote code execution.

A stored XSS vulnerability exists in Grav Core + Admin Plugin versions before 2.0.0-beta.2, where a low-privileged user can inject malicious code via a crafted tag, potentially leading to the exfiltration of admin session context, bypassing CSRF protections, and escalating to remote code execution (RCE).

A stack-based buffer overflow vulnerability exists in EFM ipTIME NAS1dual 1.5.24, affecting the get_csrf_whites function in /cgi/advanced/misc_main.cgi, exploitable remotely, and leading to potential arbitrary code execution.

A critical authentication bypass vulnerability (CVE-2026-4670) in Progress MOVEit Automation allows an unauthenticated remote attacker to gain administrative access, potentially leading to full control over the application and sensitive file transfer workflows.

A buffer overflow vulnerability exists in Totolink N300RH 3.2.4-B20220812 allowing remote attackers to execute arbitrary code by manipulating the mac_address argument in the setMacFilterRules function of the /cgi-bin/cstecgi.cgi POST request handler.

Shandong Hoteam Software PDM Product Data Management System up to version 8.3.9 is vulnerable to SQL injection via manipulation of the SortOrder argument in the GetQueryMachineGridOnePageData function of the /Base/BaseService.asmx/DataService file, allowing remote attackers to potentially execute arbitrary SQL commands.

A SQL injection vulnerability in Acrel Electrical ECEMS Enterprise Microgrid Energy Efficiency Management System 1.3.0 allows remote attackers to execute arbitrary SQL commands by manipulating the 'fCircuitids' argument in the '/SubstationWEBV2/main/elecMaxMinAvgValue' file.

A remote buffer overflow vulnerability exists in Edimax BR-6428nC devices up to version 1.16 via manipulation of the pptpDfGateway argument in the /goform/setWAN file, potentially allowing for arbitrary code execution.

A buffer overflow vulnerability exists in Edimax BR-6208AC devices (<= 1.02) via manipulation of the pptpDfGateway argument in the /goform/setWAN endpoint, potentially allowing remote attackers to execute arbitrary code.

CVE-2026-7593 is an OS command injection vulnerability in Sunwood-ai-labs command-executor-mcp-server up to version 0.1.0, allowing remote attackers to execute arbitrary commands via the execute_command function in src/index.ts.

An authentication bypass vulnerability in cPanel and WHM versions prior to 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20, and 11.136.0.5 allows unauthenticated remote attackers to gain unauthorized access to the control panel.

OpenClaw before 2026.4.8 contains a privilege escalation vulnerability where attackers can gain unauthorized write access to runtime operations by sending read-scoped requests through the gateway authentication route.

Toowiredd chatgpt-mcp-server up to version 0.1.0 is vulnerable to OS command injection via the file src/services/docker.service.ts of the component MCP/HTTP, allowing for remote exploitation.

WWBN AVideo versions 29.0 and below contain a path traversal vulnerability (CVE-2026-41058) in the CloneSite functionality, allowing unauthenticated attackers to delete arbitrary files via manipulation of the `deleteDump` parameter.

An insecure deserialization vulnerability exists in Progress Telerik UI for AJAX's RadFilter control (versions 2024.4.1114 through 2026.1.421) allowing remote code execution via tampering with the filter state exposed to the client.

CVE-2026-33519 is a critical vulnerability in Esri Portal for ArcGIS 11.4, 11.5, and 12.0, where incorrect authorization checks on developer credentials can lead to unauthorized privilege escalation on Windows, Linux, and Kubernetes deployments.

A buffer overflow vulnerability (CVE-2026-6631) in Tenda F451 router version 1.0.0.7_cn_svn7958 allows remote attackers to execute arbitrary code by manipulating the 'page' argument in the /goform/webExcptypemanFilter component.

Fastify v5.x is vulnerable to a body schema validation bypass, allowing attackers to circumvent request body validation by prepending a single space to the Content-Type header, potentially compromising data integrity and security constraints.

Jetty is vulnerable to HTTP request smuggling due to improper parsing of quoted strings in HTTP/1.1 chunked transfer encoding extension values, potentially allowing attackers to inject arbitrary HTTP requests, poison caches, and bypass security controls.

CMSsite 1.0 is vulnerable to unauthenticated SQL injection (CVE-2019-25697) via the cat_id parameter in category.php, allowing attackers to extract sensitive database information.

Chamilo LMS versions prior to 1.11.38 and 2.0.0-RC.3 generate predictable REST API keys, allowing attackers with knowledge of a username and approximate key creation time to brute-force access.