Lỗ hổng mới
Lỗ hổng nghiêm trọng mới công bố (CVSS ≥ ngưỡng) hoặc đang bị khai thác thực tế (CISA KEV), gom từ NVD, GitHub Advisory, CVE.org, OSV và CISA KEV.
| ID | Tóm tắt | CVSS | Sản phẩm / package | Công bố | Nguồn |
|---|---|---|---|---|---|
| GHSA-4xm8-rg9h-jhq2 RCE Lộ dữ liệu | Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution | 9.8 CRITICAL | npm/signalk-server, npm/@signalk/resources-provider | GitHub Advisory, OSV.dev | |
| GHSA-hff9-5pqw-6w9f RCE | imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution | 9.8 CRITICAL | go/github.com/imgproxy/imgproxy/v3, go/github.com/imgproxy/imgproxy/v2 +1 | GitHub Advisory, OSV.dev | |
| CVE-2026-63393 RCE | OpenSearch SQL plugin: Unsafe cursor deserialization permits server code execution | 8.7 HIGH | opensearch-project sql | NVD, CVE.org | |
| CVE-2026-63378 RCE | TAKO AI Agent for Okta: Authenticated Python execution through validator bypass | 8.8 HIGH | fctr-id okta-ai-agent | NVD, CVE.org | |
| CVE-2026-63346 RCE | Refitter: C# source injection through OpenAPI header parameter names | 8.6 HIGH | christianhelle refitter | NVD, CVE.org | |
| CVE-2026-63344 RCE | Refitter: C# source injection through OpenAPI content-type map keys | 8.6 HIGH | christianhelle refitter | NVD, CVE.org | |
| CVE-2026-63345 RCE | Refitter: C# source injection through OpenAPI path keys | 8.6 HIGH | christianhelle refitter | NVD, CVE.org | |
| CVE-2026-118938 RCE | Fickling check_safety() bypass: dotted qualname in STACK_GLOBAL resolves a class-method attribute path that evades call analysis | 8.8 HIGH | trailofbits fickling | NVD, CVE.org | |
| CVE-2026-16760 RCE | Fickling check_safety() bypass: likely_safe_imports grants module-origin trust to unvalidated standard library callables | 8.8 HIGH | trailofbits fickling | NVD, CVE.org | |
| CVE-2026-62853 RCE | ThingLinks vulnerable to authenticated remote code execution via Groovy script registration in ThingLinks | 9.9 CRITICAL | mqttsnet thinglinks | NVD, CVE.org | |
| CVE-2026-119332 RCE | Ladybird: FinalizationRegistry::cleanup() heap use-after-free via reentrant unregister() | 8.8 HIGH | LadybirdBrowser ladybird | NVD, CVE.org | |
| CVE-2026-116241 RCE | pgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-quoted identifier | 9.9 CRITICAL | pgadmin.org pgAdmin 4 | NVD, CVE.org | |
| CVE-2026-62284 RCE Lộ dữ liệu | OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxy | 8.6 HIGH | osac-project osac-operator | NVD, CVE.org | |
| CVE-2026-78403 RCE Truy cập trái phép | Unauthenticated Stack Buffer Overflow in Sentinel Keys Server | 9.8 CRITICAL | Thalesgroup Sentinel Keys Server | NVD, CVE.org | |
| CVE-2026-118090 RCE | WordPress MasterStudy LMS plugin <= 3.7.55 - PHP Object Injection vulnerability | 8.8 HIGH | Stylemix MasterStudy LMS | NVD, CVE.org | |
| CVE-2026-116852 RCE | WordPress Widget Options plugin <= 4.2.5 - Remote Code Execution (RCE) vulnerability | 9.1 CRITICAL | Marketing Fire Widget Options | NVD, CVE.org | |
| CVE-2026-90888 RCE | WordPress LeadSnap plugin <= 1.25 - PHP Object Injection vulnerability | 9.8 CRITICAL | leadsnap LeadSnap | NVD, CVE.org | |
| CVE-2026-78527 RCE | WordPress GS Testimonial Slider plugin <= 3.3.10 - PHP Object Injection vulnerability | 8.8 HIGH | GS Plugins GS Testimonial Slider | NVD, CVE.org | |
| CVE-2026-73186 RCE | WordPress Enable Media Replace plugin <= 4.2.2 - PHP Object Injection vulnerability | 8.8 HIGH | ShortPixel Enable Media Replace | NVD, CVE.org | |
| CVE-2026-39738 RCE | WordPress FunnelKit Automations plugin <= 3.8.6.1 - PHP Object Injection vulnerability | 9.8 CRITICAL | FunnelKit FunnelKit Automations | NVD, CVE.org | |
| CVE-2026-119526 RCE | WordPress Royal Event theme <= 2.0 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX Royal Event | NVD, CVE.org | |
| CVE-2026-119978 RCE | Flowise through 3.1.4 Custom Function Sandbox Escape RCE via LocalFileStore | 8.5 HIGH | FlowiseAI Flowise | NVD, CVE.org | |
| CVE-2026-115346 RCE | Avada | Website Builder For WordPress & WooCommerce <= 7.16.2 - Unauthenticated Arbitrary File Upload via Avada Form Upload Field | 8.1 HIGH | ThemeFusion Avada | Website Builder For WordPress & WooCommerce | NVD, CVE.org | |
| CVE-2026-119716 RCE | pybars3 through 0.9.7 Code Injection via Bracketed Path Segments | 8.1 HIGH | wbond pybars3 | NVD, CVE.org | |
| CVE-2026-119717 RCE | pybars4 through 0.9.13 Code Injection via Bracketed Path Segments | 8.1 HIGH | up9inc pybars4 | NVD, CVE.org | |
| CVE-2026-119713 RCE | Paperclip 2026.403.0 before 2026.416.0 RCE via Execution Workspace Cleanup Commands | 8.8 HIGH | paperclipai @paperclipai/server | NVD, CVE.org | |
| CVE-2026-119706 RCE | LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserialization | 9.8 CRITICAL | InternLM lmdeploy | NVD, CVE.org | |
| CVE-2026-93327 RCE | Unsafe Java Deserialization in Application Integration SubWorkflow tasks allows Remote Code Execution | 9.4 CRITICAL | Google Cloud Application Integration | NVD, CVE.org | |
| CVE-2026-61738 RCE Lộ dữ liệu | SOCFortress CoPilot: Arbitrary Host File Write as Root via Path Traversal in the ScoutSuite GCP Report Upload (RCE) | 10.0 CRITICAL | socfortress CoPilot | NVD, CVE.org | |
| CVE-2026-91913 RCE | Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker ... | 8.8 HIGH | Dell OpenManage Enterprise | NVD, CVE.org | |
| CVE-2026-118992 RCE | CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup | 8.4 HIGH | NVD, CVE.org | ||
| CVE-2026-111505 RCE | Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker ... | 8.8 HIGH | Dell OpenManage Enterprise | NVD, CVE.org | |
| CVE-2026-119408 RCE | n8n before 2.42.6, 2.43.3 and 3.0.1 Code Execution Outside Task Runner Isolation via Deprecated Function Nodes | 8.8 HIGH | n8n-io n8n | NVD, CVE.org | |
| CVE-2026-116366 RCE | Unauthenticated RCE vulnerability against ClickHouse Server | 9.5 CRITICAL | ClickHouse ClickHouse, ClickHouse ClickHouse Cloud | NVD, CVE.org | |
| CVE-2025-31704 RCE | Dahua Intelligent Connection Center command injection | 9.8 CRITICAL | Dahua Intelligent Connection Center | NVD, CVE.org | |
| CVE-2026-103039 RCE | Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field | 9.8 CRITICAL | Gravity Forms Gravity Forms | NVD, CVE.org | |
| CVE-2026-119270 RCE | Improper input validation in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromi... | 8.8 HIGH | Google Chrome | NVD, CVE.org | |
| CVE-2026-119271 RCE | Use after free in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | 8.8 HIGH | Google Chrome | NVD, CVE.org | |
| CVE-2026-119263 RCE | Memory corruption in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium... | 9.6 CRITICAL | Google Chrome | NVD, CVE.org | |
| CVE-2026-119264 RCE | Memory corruption in Dawn in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security seve... | 8.8 HIGH | Google Chrome | NVD, CVE.org | |
| CVE-2026-119265 RCE | Memory corruption in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security sev... | 8.8 HIGH | Google Chrome | NVD, CVE.org | |
| CVE-2026-119266 RCE | Use after free in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severi... | 8.8 HIGH | Google Chrome | NVD, CVE.org | |
| CVE-2026-119267 RCE | Memory corruption in DOM in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security sever... | 8.8 HIGH | Google Chrome | NVD, CVE.org | |
| CVE-2026-119268 RCE | Integer overflow in Editing in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security se... | 8.8 HIGH | Google Chrome | NVD, CVE.org | |
| CVE-2026-119269 RCE | Use after free in Blink in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | 8.8 HIGH | Google Chrome | NVD, CVE.org | |
| CVE-2026-119260 RCE | Use after free in Frames in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | 8.8 HIGH | Google Chrome | NVD, CVE.org | |
| CVE-2026-119261 RCE | Improper input validation in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium secu... | 9.6 CRITICAL | Google Chrome | NVD, CVE.org | |
| CVE-2026-119262 RCE | Improper input validation in V8 in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium securit... | 8.8 HIGH | Google Chrome | NVD, CVE.org | |
| CVE-2026-76028 RCE | Use after free in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | 8.8 HIGH | Google Chrome | NVD, CVE.org | |
| CVE-2026-76029 RCE | Memory corruption in Network in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security s... | 8.8 HIGH | Google Chrome | NVD, CVE.org |