News · via Exploit-DB
[webapps] Keycloak 26.7.2 - Unauthenticated Account Takeover
Keycloak 26.7.2 - Unauthenticated Account Takeover
Exploit
Coverage tagged "Exploit".
News · via Exploit-DB
[webapps] Automotive Shop Management System 1.0 - SQLi
Automotive Shop Management System 1.0 - SQLi
News · via Exploit-DB
[remote] Edimax BR-6478AC firmware v2.20 - authenticated command injection
Edimax BR-6478AC firmware v2.20 - authenticated command injection
News · via Exploit-DB
[remote] Exasol Database 7.1.30 - command execution
Exasol Database 7.1.30 - command execution
News · via Exploit-DB
[remote] Parasoft Continuous Testing Platform 10.7.5 - JSP command execution
Parasoft Continuous Testing Platform 10.7.5 - JSP command execution
News · via Exploit-DB
[remote] ProSoft RLX-IFH24E v2.2.44 - Unsigned Firmware Upgrade Package Executed as Root
ProSoft RLX-IFH24E v2.2.44 - Unsigned Firmware Upgrade Package Executed as Root
News · via Exploit-DB
[remote] South River Technologies Titan MFT Server 26.0.0 - code execution
South River Technologies Titan MFT Server 26.0.0 - code execution
News · via Exploit-DB
[remote] Synametrics Syncrify 6.2 - command execution
Synametrics Syncrify 6.2 - command execution
News · via JFrog Security Research
PHP2Shell - All You Need to Know About CVE-2026-109618 and CVE-2026-109619
Two critical Remote Code Execution vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, are scheduled for disclosure before a fix is available to organizations. JFrog is closely monitoring…
News · via Elastic Security Labs
php2shell: Assessing Elastic detection coverage relevant to CVE-2026-109618 and CVE-2026-109619
On October 20, 2026, details of two critical remote code execution vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, leaked online ahead of their coordinated disclosure and before any…
News · via Recorded Future
PHP2Shell Exploitation: Two Critical PHP Flaws Explained
Two critical remote code execution vulnerabilities in the PHP engine, CVE-2026-109618 and CVE-2026-109619 (nicknamed “PHP2Shell”), are reportedly being targeted in active exploitation attempts…
News · via CyberScoop
Philippines-based American pleads guilty to running expansive fraud scheme targeting US servicemembers
A 45-year-old U.S. citizen pleaded guilty to running a widespread identity theft and fraud scheme that defrauded thousands of U.S. servicemembers and veterans while living in the Philippines, the…
News · via Wordfence
PSA: Upcoming Critical PHP Security Release
The PHP security team has issued advance notice of an upcoming critical security release, scheduled for Wednesday, October 21, 2026 at 14:00 UTC (10:00 AM Eastern). The release fixes two critical…
News · via Cloudflare
8 eMudhra certificates are compromised. Here's what you need to know
On October 19, 2026, at approximately 17:00 UTC, Cloudflare became aware that private keys associated with eight eMudhra intermediate certificates were compromised. These certificates were widely…
News · via Tenable
Oracle October 2026 Critical Patch Update Addresses 1209 CVEs
Oracle addresses 1209 CVEs in its final quarterly update of 2026 with 1295 patches, including 112 critical updates.
News · via Wordfence
Wordfence Argus Discovers High Severity Unauthenticated PHP Object Injection in Duplicator
On August 30, 2026, during internal research, the Wordfence Threat Intelligence Team discovered an Unauthenticated PHP Object Injection vulnerability in Duplicator and Duplicator Pro. Duplicator has…
News · via Canadian Centre for Cyber Security
Gitea security advisory (AV26-845) - Update 1
Serial Number: AV26-845 Date: August 25, 2026 Updated: October 20, 2026 As of August 14, 2026, Gitea is affected by vulnerabilities in the following product: Gitea Prior to 1.27.1 Update 1…
News · via DataBreaches.net
Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA
Ravie Lakshmanan reports: Palo Alto Networks has disclosed that it’s continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access by ransomware actors. The…
News · via The Hacker News
Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution
Cybersecurity researchers have released a proof-of-concept (PoC) exploit for a recently patched critical security flaw impacting Fortinet FortiSIEM that could result in arbitrary code execution. The…
News · via The Hacker News
Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA
Palo Alto Networks has disclosed that it's continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access by ransomware actors. The activity relates to…