CVE-2017-12611: Struts Freemarker Tag RCE
CVE-2017-12611 is a remote code execution vulnerability in Apache Struts via the Freemarker tag.
Tag: RCE
GitHub Copilot CLI Search Order Hijacking Vulnerability
GitHub Copilot CLI, along with other AI tools, is vulnerable to search order hijacking, allowing attackers to place malicious binaries in the…
CVE-2026-10591: Amazon Kiro Insufficient Access Control
Amazon addressed an insufficient access control flaw in Kiro IDE (CVSS 8.8) that could allow a remote unauthenticated attacker to execute arbitrary…
Microsoft SQL Server
SQL Server is a relational database management system developed by Microsoft. It had two RCE vulnerabilities patched in July 2026.
SquareShell: Web Shell Deployed via Roundcube RCE
SquareShell is a web shell deployed by UNK_MassTraction using a PHP gadget shell command after exploiting CVE-2025-49113 in Roundcube. It is accessible…
Joomla SP Page Builder Plugin
Joomla SP Page Builder is a page builder plugin for Joomla, associated with CVE-2026-48908 used as a lure in the ChocoPoC campaign.
CVE-2025-55182: React2Shell Vulnerability
A remote code execution vulnerability in React applications, used as a lure in the ChocoPoC campaign.
GeoServer: Open-Source Mapping Server Under Active Attack
GeoServer is an open-source server for sharing geospatial data. A newly disclosed zero-day SQL injection vulnerability is being actively exploited, potentially leading…
CVE-2026-33017: Langflow RCE Vulnerability
A critical RCE vulnerability in Langflow (CVSS 9.8) that was exploited by the AI-driven threat actor but failed due to restrictive configurations.
Langflow: Open-Source AI Application Development Platform
Langflow is an open-source AI application development platform that has been targeted by multiple RCE vulnerabilities.