#RCE

Deep Dive

A newline in a PDF metadata key runs ExifTool Perl code as a command on unauthenticated Gotenberg servers before 8.31.0; exploited by seven clusters.

Deep Dive

Unauthenticated RCE in PeopleTools 8.61 and 8.62 through an SSRF chain into PSEMHUB: exploited as a zero-day by ShinyHunters, fixed June 10.

Deep Dive

FortiSIEM 7.5.0's unauthenticated gRPC service on TCP 27918 lets an attacker overwrite files for RCE; fixed in 7.5.1, public PoC, no known exploitation.

Deep Dive

PAN-OS is actively exploited; separately, a chain rooted 25 servers via an undisclosed vendor's firewalls: PHP RCE fixed in 8.5.12, 8.4.27, 8.3.36, 8.2.35.

Deep Dive

GHSA-673q-mjm6-r5xr is rated Critical, CVSS v4.0 9.5, in the GitHub Advisory Database: an unauthenticated attacker can run code on a Next.js 16 server that uses App Router with Cache Components and has a use cache function returning multiple typed arrays. The database review classifies the flaw as deserialization of untrusted data (CWE-502) in the React Server Components transport protocol that Next.js bundles. Fixed in Next.js 16.4.1, with no workaround available.

Security

A technical breakdown of CVE-2026-44109, a CVSS 9.2 Critical authentication bypass vulnerability in OpenClaw (< 2026.4.15). Two fail-open logic inversions in the Feishu/Lark plugin — one in the webhook signature validator and one in the card-action replay guard — allow an unauthenticated attacker to inject arbitrary events into OpenClaw's command dispatch engine. When the bot has execution tools enabled, this translates directly to unauthenticated remote code execution on the host machine with the privileges of the OpenClaw process.

Security

A technical breakdown of CVE-2026-26720, a CVSS 9.8 Critical authenticated Remote Code Execution vulnerability in Twenty CRM (≤ v1.15.0). Any workspace member can create and execute serverless functions that run unsandboxed with full access to process.env, leaking APP_SECRET, PG_DATABASE_URL, and all server-side credentials. When combined with webhook-triggered workflows exposed via PublicEndpointGuard, a single authenticated attacker can install a permanent unauthenticated RCE backdoor accessible from anywhere on the internet.

Security

A technical breakdown of CVE-2026-27971, a CVSS 9.2 critical unauthenticated remote code execution vulnerability in Qwik (< 1.19.1). Unsafe deserialization in the server$ RPC flow allows attacker-controlled QRL objects to be reconstructed from application/qwik-json requests, enabling arbitrary module path and symbol resolution and, where require() is available,remote code execution via crafted server-side function invocation.

Security

A technical breakdown of CVE-2026-2599, a CVSS 9.8 Critical unauthenticated PHP Object Injection vulnerability in the "Contact Form Entries" WordPress plugin (≤ 1.4.7). The download_csv function deserializes untrusted user input without allowed_classes restrictions. When combined with WordPress 6.4.0-6.4.1, the built-in WP_HTML_Token class provides a complete all-public POP chain leading to full Remote Code Execution via two unauthenticated HTTP requests.

Security

Analysis of GHSA-cr3w-cw5w-h3fj, a CVSS 9.7 critical XSS-to-RCE vulnerability in Saltcorn (≤ 1.5.0-beta.19). Two chained flaws, reflected XSS in route parameters and command injection in backup generation, enable remote code execution via administrator phishing.