Linux kernel RCE CVE-2026-98432
CVSSv3 Score: 9.8 CVE-2026-98432:ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_
Multiple Node.js CVEs
CVSSv3 Score: 9.8 CVE-2026-105482 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105483 - (high)This vulnerability affects Node.js 26.x and 24.x.CVE-2026-106069 - (high
PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE
Exploit público para PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE (CVE-2026-109618).
Automotive Shop Management System 1.0 - SQLi
Se ha publicado un exploit de inyección SQL para Automotive Shop Management System 1.0, permitiendo a atacantes remotos ejecutar consultas arbitrarias y comprometer la base de datos.
Edimax BR-6478AC firmware v2.20 - authenticated command injection
Un exploit público permite inyección de comandos autenticada en routers Edimax BR-6478AC con firmware 2.20, facilitando control remoto.
Exasol Database 7.1.30 - command execution
Se publicó un exploit remoto que permite ejecución de comandos en Exasol Database 7.1.30, sin CVE asociado y autor desconocido.
PHP core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)
CVSSv3 Score: 9.8 CVE-2026-109618PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this
Keycloak 26.7.2 - Unauthenticated Account Takeover
Se publica un PoC que permite tomar el control de cuentas en Keycloak 26.7.2 sin necesidad de credenciales, poniendo en riesgo instancias expuestas.
Open eClass 3.15 - RCE
Se ha publicado un exploit de ejecución remota de código para Open eClass 3.15, plataforma de e-learning usada en entornos educativos.
Parasoft Continuous Testing Platform 10.7.5 - JSP command execution
Exploit público para Parasoft Continuous Testing Platform 10.7.5 - JSP command execution.
pizzafy-1.0 - SQLi
Se publicó un PoC de inyección SQL en la aplicación web Pizzafy versión 1.0, permitiendo acceso no autorizado a la base de datos.
ProSoft RLX-IFH24E v2.2.44 - Unsigned Firmware Upgrade Package Executed as Root
Un exploit público permite actualizar el firmware del gateway industrial ProSoft RLX-IFH24E sin verificación de firma, ejecutando código como root de forma remota.
South River Technologies Titan MFT Server 26.0.0 - code execution
Exploit público para South River Technologies Titan MFT Server 26.0.0 - code execution.
Synametrics Syncrify 6.2 - command execution
Exploit público para Synametrics Syncrify 6.2 - command execution.
HTML injection in WebUI
CVSSv3 Score: 4.9 An improper neutralization of script-related HTML tags in a web page in FortiManager and FortiAnalyzer may allow an attacker to perform a cross site scripting (XSS) attack via
Persistent Denial of Service in Admin Profile
CVSSv3 Score: 4.8 An Uncaught Exception vulnerability [CWE-248] in FortiSandbox may allow a privileged attacker to deny access to the GUI and CLI persistently via crafted HTTP requests. Re
arbitrary command execution in fgfmsd daemon
CVSSv3 Score: 5.3 An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiManager fgfmd daemon may allow a remote attacker im
Multiple Arbitrary File Read/Write via SQL Injection
CVSSv3 Score: 7.9 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiAnalyzer, FortiManager, FortiManager Cloud and FortiAnaly
Fabric API Authentication bypass
CVSSv3 Score: 4.9 A Use of Hard-coded Cryptographic Key [CWE-321] in FortiSandbox and FortiSandbox Cloud API may allow an unauthenticated attacker to access some endpoints via specially crafted
Arbitrary file write in grpc phQueryMaster
CVSSv3 Score: 9.4 An Improper limitation of a pathname to a restricted directory ('path traversal') [CWE-22] in FortiSIEM may allow an unauthenticated attacker to execute unauthorized code or co