Skip to content
Threat Feed
Subscribe

Vendor

ComfyUI

3 briefs RSS
high advisory

Path Traversal in ComfyUI Dataset Save Nodes

ComfyUI versions prior to 0.30.0 are vulnerable to path traversal via unsanitized input in dataset save nodes, allowing attackers to write arbitrary files and potentially achieve code execution.

ComfyUI web-vulnerability path-traversal cve-2026-92816
2t 1c
critical advisory

Unauthenticated Remote Code Execution in ComfyUI via Unsafe Deserialization

ComfyUI version 0.23.0 is vulnerable to unauthenticated remote code execution via unsafe deserialization of malicious pickle files.

PoC ComfyUI +1 remote-code-execution deserialization cve-2026-68771
1r 2t 1c updated
critical threat

CVE-2026-63030: Critical Remote Code Execution Vulnerability in WordPress Core

CVE-2026-63030 is a critical unauthenticated remote code execution vulnerability affecting WordPress Core versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1, allowing an unauthenticated attacker to execute arbitrary code via the WordPress REST API batch endpoint, potentially leading to complete website compromise.

exploited PoC WordPress Core 6.9.0 +51 wordpress rce web-vulnerability cve
2t 15c 8i updated