9 posts
PHP2Shell exposes two core PHP memory-safety flaws, each rated Critical (CVSS v4.0 9.2), that can enable unauthenticated remote code execution. Fixes are available, and exploitation in the wild has been reported.
CVE-2026-19478 is a critical CVSS 9.4 GitLab GraphQL code injection vulnerability that can allow unauthenticated attackers to modify or delete public projects and user data. No verified public PoC or active exploitation has been confirmed as of August 18, 2026.
An unsafe PyTorch deserialization path in ComfyUI allows unauthenticated attackers to execute arbitrary commands using a malicious pickle shard. CVSS 9.3; no public PoC or confirmed successful exploitation, although exploitation attempts are reportedly being tracked.
A CVSS 9.8 WordPress Core vulnerability chain lets unauthenticated attackers turn REST route confusion and SQL injection into remote code execution. Public PoCs are available, with early signs of in-the-wild activity reported.
A missing access check in SP Page Builder's icon-upload endpoint gave unauthenticated attackers direct RCE on every Joomla site running the extension. CVSS 10.0, actively exploited, patch available.
A CVSS 9.8 authentication bypass in ThingsBoard's Apple OAuth 2.0 flow lets a remote attacker impersonate an existing user and take over the account. A public PoC exists, while active exploitation has not been reported.
A critical (CVSS 9.6) information-disclosure flaw in LibreChat lets any authenticated user exfiltrate JWT signing keys, AES encryption keys, and database credentials by injecting environment-variable placeholders into a malicious MCP server URL. Patched in v0.8.4-rc1.
A double-free vulnerability in Apache HTTP Server 2.4.66's mod_http2 module (CVSS 8.8) allows unauthenticated attackers to crash worker processes with just two HTTP/2 frames, and escalate to full RCE.
A look at the critical cPanel & WHM authentication bypass. What happened, who was affected, and what you need to do right now.