Lỗ hổng mới
Lỗ hổng nghiêm trọng mới công bố (CVSS ≥ ngưỡng) hoặc đang bị khai thác thực tế (CISA KEV), gom từ NVD, GitHub Advisory, CVE.org, OSV và CISA KEV.
| ID | Tóm tắt | CVSS | Sản phẩm / package | Công bố | Nguồn |
|---|---|---|---|---|---|
| CVE-2026-103402 RCE Truy cập trái phép | Session Smart Router and Session Smart Conductor: Lack of integrity verification in cache files causes arbitrary code execution and privilege escalation | 8.8 HIGH | Juniper Networks Session Smart Router, Juniper Networks Session Smart Conductor | NVD, CVE.org | |
| CVE-2026-118510 RCE | Laravel MongoDB whereDoesntHave misses deny records for numeric string IDs | 8.8 HIGH | MongoDB Laravel MongoDB | NVD, CVE.org | |
| CVE-2026-116778 RCE Truy cập trái phép | FOG: Authenticated low-privileged API user can modify Storage Nodes and reach root command execution | 8.8 HIGH | FOGProject fogproject | NVD, CVE.org | |
| CVE-2026-44179 RCE | XWiki Pro Macros: excerpt-include title and content injection executes code | 9.9 CRITICAL | xwikisas xwiki-pro-macros | NVD, CVE.org | |
| CVE-2026-115968 RCE | WordPress Ultimate Member plugin <= 2.13.1 - PHP Object Injection vulnerability | 9.8 CRITICAL | Ultimate Member Ultimate Member | NVD, CVE.org | |
| CVE-2026-116389 RCE | WordPress Phoenix Media Rename plugin <= 3.13.5 - PHP Object Injection vulnerability | 8.8 HIGH | crossi72 Phoenix Media Rename | NVD, CVE.org | |
| CVE-2026-105420 RCE Lộ dữ liệu | Path Traversal in Wing WFTP Server leading to Remote Code Execution | 9.4 CRITICAL | Wing Soft Technology Wing FTP Server | NVD, CVE.org | |
| CVE-2026-116391 RCE | WordPress GS Logo Slider plugin <= 3.8.9 - PHP Object Injection vulnerability | 8.8 HIGH | GS Plugins GS Logo Slider | NVD, CVE.org | |
| CVE-2026-115904 RCE | Topluyo Desktop for Linux has an OS Command Injection issue | 9.6 CRITICAL | topluyo App | NVD, CVE.org | |
| CVE-2026-67073 RCE Truy cập trái phép Lộ dữ liệu | HCL BigFix AEX is affected by multiple security vulnerabilities. | 8.6 HIGH | HCL Software BigFix AEX | NVD, CVE.org | |
| CVE-2026-67074 RCE | HCL BigFix AEX is affected by multiple security vulnerabilities. | 9.1 CRITICAL | HCL Software BigFix AEX | NVD, CVE.org | |
| CVE-2026-114278 RCE | Unauthenticated Command Injection via kubeconfig Username in che-machine-exec | 9.8 CRITICAL | Eclipse Foundation Eclipse Che | NVD, CVE.org | |
| CVE-2026-118477 RCE | KaliFast Project Management Platform ei_git_repo_url OS Command Injection | 9.8 CRITICAL | EISGE Kalifast | NVD, CVE.org | |
| CVE-2026-103780 RCE | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release ... | 9.8 CRITICAL | Dell PowerProtect Data Domain | NVD, CVE.org | |
| CVE-2026-86378 RCE | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release ... | 8.8 HIGH | Dell PowerProtect Data Domain | NVD, CVE.org | |
| CVE-2026-86396 RCE | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release ... | 8.8 HIGH | Dell PowerProtect Data Domain | NVD, CVE.org | |
| CVE-2026-86400 RCE Truy cập trái phép | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release ... | 9.8 CRITICAL | Dell PowerProtect Data Domain | NVD, CVE.org | |
| CVE-2026-109218 RCE | Contact Manager <= 9.1.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist Bypass | 9.8 CRITICAL | kleor Contact Manager | NVD, CVE.org | |
| CVE-2026-109384 RCE | The Innovative Form Builder <= 1.5.1 - Authenticated (Custom+) Arbitrary File Upload via 'allowedFileExtensions' Configuration + Public /form/submission/ Multipart Upload | 8.8 HIGH | melograno The Innovative Form Builder – IvyForms | NVD, CVE.org | |
| CVE-2026-111120 RCE | VikRentCar Car Rental Management System <= 1.4.8 - Cross-Site Request Forgery to Remote Code Execution via 'condtext_update_tmpl' AJAX Task | 8.8 HIGH | e4jvikwp VikRentCar Car Rental Management System | NVD, CVE.org | |
| CVE-2026-103688 RCE | Checkout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File Upload | 9.8 CRITICAL | Unknown Checkout Files Upload for WooCommerce | NVD, CVE.org | |
| CVE-2026-97229 KEV RCE | GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability | — | GitLab Community Edition and Enterprise Edition | CISA KEV |