WordPress CVE-2026-87902: Unauthenticated RCE Exploited Within Hours
CVE-2026-87902 is a critical WordPress Core RCE flaw, exploited within hours of patch. See affected versions, exploitation flow,…
Category
Security Bulletin
86 articles
Next.js CVE-2026-94545: Critical ImageResponse Vulnerability Enables RCE via SVG
Next.js CVE-2026-94545 (CVSS 9.5) enables RCE through next/og SVG image generation. Learn affected versions, the Satori root cause,…
CVE-2026-35273: ShinyHunters Resumes Oracle PeopleSoft Exploitation with WAF Bypass
ShinyHunters now bypasses WAF rules to exploit Oracle PeopleSoft CVE-2026-35273. See the new attack chain, detection steps, and…
CVE-2026-67401: SQL Injection in cPanel’s EmailTrack Puts Shared Hosting Environments at Risk
cPanel disclosed a critical EmailTrack flaw letting standard mail accounts reach root access. Check affected versions, patch links,…
CVE-2026-0768: Critical RCE in Langflow AI Agent Builder
Critical Langflow RCE (CVE-2026-0768) is under active exploitation via the validate endpoint. Learn the impact, IOCs, and how…
SharePoint CVE-2026-55040 Actively Exploited: AI-Discovered RCE Chain
CVE-2026-55040, a critical SharePoint authentication bypass, is now being actively exploited. A proof-of-concept went public on August 11.…
CVE-2026-9198: Critical Langflow RCE Under Active Exploitation
CVE-2026-9198 lets attackers chain two Langflow API endpoints for unauthenticated RCE. CISA confirms active exploitation. See fixes and…
CVE-2026-58048: cPanel & WHM Database Privilege Escalation Vulnerability
CVE-2026-58048 lets low-privilege cPanel accounts escalate to root database access via a public PoC. Explore risk details and…
Oracle’s July 2026 CPU: Critical Unauth Vulnerabilities in PeopleSoft, WebLogic, and E-Business Suite
Oracle's largest-ever CPU patches critical unauthenticated flaws in PeopleSoft, WebLogic, and E-Business Suite. See AppTrana's coverage for each.
Copilot RCE, Entra SSRF, and SharePoint Zero-Day: Critical Vulnerabilities in Microsoft’s July 2026 Advisory
An actively exploited SharePoint zero-day, Copilot command injection, and Entra SSRF top Microsoft's July 2026 advisory. Get the…
CVE-2026-6875: ServiceNow Sandbox Escape Leads to Pre-Auth RCE in AI Platform
Critical unauthenticated RCE vulnerability CVE-2026-6875 hits ServiceNow via a GlideRecord sandbox escape. Attackers are already exploiting unpatched instances.
WP2Shell: WordPress Core SQLi + REST API Chain to Pre-Auth RCE
WP2Shell chains CVE-2026-60137 and CVE-2026-63030 for unauthenticated RCE on WordPress Core. Patch to 6.8.6, 6.9.5, or 7.0.2 now,…