60
60
Ivanti Patches Critical Remote Code Execution Flaws in Endpoint Manager
60
42
47
Hackers Actively Searching for Unpatched Microsoft Exchange Servers
60
Microsoft Issues Updates for 96 Vulnerabilities You Need to Patch this Month
60
60
60
Trend Micro fixed a remote code execution in Apex Central
60
60
60
60
Microsoft Patch Tuesday for May 2026 fix 138 bugs, some of them are alarming
60
60
60
60
60
47
60
60
60
60
60
Microsoft Patch Tuesday
60
60
Microsoft Patch Tuesday for August 2025 — Snort rules and prominent vulnerabilities
60
60
Microsoft Patch Tuesday for December 2024 contains four critical vulnerabilities
60
60
Microsoft Patch Tuesday security updates for August 2024 six actively exploited bugs
60
Talos reported WebKit flaws in WebKit that allow Remote Code Execution
60
Microsoft's Latest Security Update Fixes 64 New Flaws, Including a Zero
60
Unauthenticated PHP Object Injection to Remote Code Execution on GiveWP
Patchstack details an unauthenticated PHP object injection chain enabling remote code execution in the GiveWP WordPress donation plugin.
Patchstack disclosed an unauthenticated remote code execution vulnerability in the GiveWP WordPress donation plugin. An attacker with no account can execute arbitrary commands on the server of an affected GiveWP site. The full chain is reachable when a site has one published donation form and one active payment gateway, a configuration the researcher describes as a common default.
42
60
55
Flextype v1.0.0-alpha.3 CMS registerShortcodes() Remote Code Execution via Attacker-Controlled File Inclusion
Flextype CMS v1.0.0-alpha.3 allows PHP remote code execution via path traversal in the Entries API combined with shortcode file inclusion.
Flextype CMS v1.0.0-alpha.3 exposes a remote code execution path through the interaction of the Entries API and Shortcodes::registerShortcodes(). The /api/v1/entries endpoint accepts attacker-controlled entry identifiers containing path traversal sequences, allowing PHP-containing content to be written outside the intended entries directory. A subsequent attacker-controlled path can then be included and executed as PHP. Ron E posted the disclosure to the Full Disclosure mailing list on September 3, 2026.
34
55
47
60