42
55
55
60
55
55
60
60
Containers on fire: from container escapes to supply chain attacks
60
42
55
55
42
60
60
Payara 7.2026.1.RC1 Remote Code Execution via Server-Side Includes #exec Directive in Payara Server
Payara Server 7.2026.1.RC1 executes arbitrary OS commands when user-controlled Server-Side Includes #exec directives are passed to Runtime.exec without validation.
Payara Server contains a vulnerability in its Server-Side Includes (SSI) implementation that permits arbitrary operating system command execution via the #exec directive. User-controlled SSI directives are passed directly to Runtime.exec() without validation, sanitization, or restriction. An attacker who can cause the server to process an SSI file such as .shtml can execute arbitrary OS commands. The disclosed affected version is 7.2026.1.RC1.
35
42
35
60
30
60
30
55
60
55
55
30
55
30
47
35
30
55
30
ZDI-26-578: NGINX HTTP Dav Module Alias Directive Integer Underflow Remote Code Execution Vulnerability
An unauthenticated integer underflow (CVE-2026-27654, CVSS 8.1) in NGINX's HTTP Dav module alias directive enables remote code execution.
ZDI advisory ZDI-26-578 describes an integer underflow in the alias directive of the NGINX HTTP Dav module that allows remote attackers to execute arbitrary code. Authentication is not required to exploit the vulnerability. ZDI rated the issue 8.1 on CVSS and assigned CVE-2026-27654.
30
60
60
30
55
55