Unauthenticated FortiMail SQL injection can execute code or commands
Fortinet rates the FortiMail flaw CVSS 9.4 and says crafted requests are enough, with no login required.
Stories per day · 30 days
3 RSS
Relatedrce12wordpress4fortinet3php3sql-injection3gitlab2path-traversal2php2shell2remote-code-execution2wordfence2ai-agent1apache1apache-answer1apache-kylin1asyncos1auerswald1authentication-bypass1cert-eu1
46 stories, newest first · one card per story
Stories tagged #unauthenticated
Unauthenticated FortiMai path traversal may allow command execution
Fortinet scores the issue CVSS 7.5; the November 10 revision does not list versions or attacks.
React Server Components flaw enables unauthenticated RCE
React advisory GHSA-xqc2-xf4c-x3h3 rates CVSS 9.5; attackers can execute code remotely without authentication in react-server-dom packages.
SonicWall warns of unpatched flaws in end-of-life GMS software
Two flaws in SonicWall GMS 9.5.2 and earlier allow file reads and SQL injection but will not be patched as the product reaches end of life.
CISA Adds WordPress Core Vulnerability to KEV Catalog
CVE-2026-119977 TOCTOU race condition enables unauthenticated remote code execution during upgrades.
Apache ZooKeeper quota subsystem allows unauthenticated DoS (CVE-2026-100300)
Affects ZooKeeper 3.8.0-3.9.6; unauthenticated DoS by writing to /zookeeper/quota subtree
Quest Foglight for Databases Deserialization Flaw Enables Remote Code Execution
Unauthenticated remote attackers can execute arbitrary code in Quest Foglight for Databases via a deserialization vulnerability (CVE-2026-92190).
Critical Langflow Flaws Allow Unauthenticated Code Execution
Four flaws in Langflow 1.0.0-1.12.8 enable unauthenticated RCE and auth bypass; upgrade to 1.13.0 fixes them.
WordPress core RCE under active attack; Wordfence blocks 58,693 attempts
CVE-2026-119977 in WordPress 4.7 through 7.1.3 can yield unauthenticated PHP execution during brief upgrades; 7.1.4 patches it.
3
WordPress update RCE attacked hours after the 7.1.4 patch
Wordfence logged more than 18,500 requests to temporary installer paths in 21 hours; Core 4.7 through 7.1.3 is affected.
NUUO Crystal Server 3.19.0.85 allows unauthenticated PHP upload to RCE
Uploaded PHP can execute through FastCGI as the web service account, rated 9.8 Critical.
GitLab RCE flaw scores CVSS 10 (CVE-2026-110264)
Community and Enterprise builds from 7.0 before the listed 18.x and 19.x patches need urgent updates.
PHP core flaws allow unauthenticated remote code execution
CVE-2026-109618 and CVE-2026-109619, called PHP2Shell, each score CVSS 9.2; emergency patches are out.
PHP fixes two critical RCE flaws, CVE-2026-109618 and CVE-2026-109619
Patched builds are 8.2.35, 8.3.36, 8.4.27 and 8.5.12; PHP 5 through 8.1 stay vulnerable and unpatched.
Chained WordPress flaws allow unauthenticated site takeover
WP2Shell chains CVE-2026-63030 and CVE-2026-60137; fixes are 6.8.6, 6.9.5 and 7.0.2.
PHP flaws CVE-2026-109618 and CVE-2026-109619 may allow unauthenticated RCE
CERT-EU says details are unpublished, every PHP release since PHP 5 may be affected, and the fix is set for 21 October at 14:00 UTC.
CVE-2026-76994: Apache Answer: Exposure of Hidden Question Metadata Through Public Answer Profiles
Unauthenticated users can pull hidden-question metadata from Apache Answer public profiles.
CVE-2026-108823: Apache Kylin: Potential unauthenticated job metadata replacement
Apache Kylin 4.0.0–5.0.4 may allow unauthenticated replacement of job metadata if services are exposed.
[0day-rubbish] Auerswald COMmander 6000 / 6000R 8.6D unauthenticated provisioning import zip-slip to root binary hijack and root code execution (9.8)
Unauthenticated zip-slip in Auerswald COMmander 6000 firmware 8.6D yields root code execution.
Cisco Warns of Exploited Secure Email Gateway Vulnerability
Cisco says attackers are exploiting critical unauthenticated CVE-2026-76519 in Secure Email Gateway for root access.
10
GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code
GitLab patched CVE-2026-97229, a CVSS 10.0 bug letting unauthenticated users run code on CE and EE servers.
2
Arbitrary file write in grpc phQueryMaster
Fortinet warns of a CVSS 9.4 FortiSIEM path traversal letting unauthenticated attackers run commands.
CVE-2026-85097: Bricksforge WordPress Plugin Flaw Exploited for Unauthenticated RCE
CVE-2026-85097 in the Bricksforge WordPress plugin is being exploited for unauthenticated remote code execution.
3
Critical WordPress Bricksforge Flaw Lets Unauthenticated Attackers Execute Remote Code
Attackers are exploiting unauthenticated RCE CVE-2026-85097 in the WordPress Bricksforge plugin.
11