Click2Shell Turns a WordPress Admin Visit Into a Forced Theme Installation
WordPress patched Click2Shell flaw letting attackers trick admins into installing themes, chainable to RCE. Update to 7.1.1 now.
Vulnerabilities
More news
Page 14 / 39 · 347 articles
Four Public Linux Kernel Exploits Put Unpatched Hosts at Risk of Local Root
Four Linux kernel bugs with public exploits risk local root on unpatched hosts. Covers DirtyAH6, TUNderflow, PPPoEject, DiagSpill, impact and fixes.
PowerChute Authentication Flaw Opens the Door to Unlimited Login Attempts
Schneider Electric CVE-2026-13348 lets remote attackers brute-force PowerChute Serial Shutdown logins. Learn affected versions and how v1.6 fixes it.
Azure AI Foundry Authentication Failure Earns Maximum-Severity CVSS Rating
Microsoft mitigated CVE-2026-85889, a CVSS 10.0 auth flaw in Azure AI Foundry allowing remote privilege escalation, plus Copilot and Azure bugs.
Exposed Orkes Conductor APIs Turn Workflow Scripts Into Root-Level Attack Paths
Unauthenticated CVE-2026-58138 in Orkes Conductor allows RCE via malicious workflows. Learn affected versions, active exploitation, and how to patch.
Mitsubishi Engineering Tools Expose Control Programs Through Local Password Bypass
CVE-2026-15688 lets local attackers bypass GX Works3 block-password protection to access control programs. Learn affected versions and fixes.
Mitsubishi Protocol Flaw Exposes Industrial Control Traffic to On-Segment Tampering
CVE-2026-13584 in Mitsubishi CC-Link IE TSN lets on-segment attackers tamper control traffic, disrupt operations or cause downtime. No patch yet.
Five Hitachi Energy FCP Flaws Expose Grid-Control Systems to Data, File and Session Attacks
Five Hitachi Energy FCP flaws, with CVSS 9.9, expose grid systems with GWS to data injection, file traversal, session hijack and phishing risks.
Unbound DNSSEC Heap Overflow Puts Vulnerable Resolvers at Risk of Remote Code Execution
NLnet Labs patched CVE-2026-81642, a critical Unbound DNSSEC heap overflow before 1.26.1 that allows DoS or RCE via malicious DNSKEY. Upgrade now.