Activity

This is a serious vulnerability affecting all supported WordPress versions. It can be exploited by any unauthenticated attacker, and a working proof of concept is available. However, to achieve remote code execution an attacker must trick a WordPress admin into opening a malicious link as part of a social engineering attack. Intruder expects a full exploit to become widely available. This vulnerability is patched in WordPress 7.0.3 (released Aug 6, 2026).)

CVE-2026-64638 is a pre-authentication reflected Cross-Site Scripting (XSS) vulnerability present in the login screen of all WordPress versions. This flaw allows for the execution of XSS without requiring attacker privileges or direct victim interaction once a specially crafted request is delivered. The vulnerability originates from how WordPress processes the username during a failed login attempt, specifically concerning the `sanitize_user()` and `wp_strip_all_tags()` functions, which can mishandle tag-like strings containing whitespace. Under specific circumstances, this XSS vulnerability can be escalated to achieve PHP code execution on the server. This escalation path is more involved, typically requiring a victim who is already logged in as a single-site Administrator to interact with an attacker-controlled page, alongside certain WordPress features and deployment conditions being met. WordPress addressed this issue in version 7.0.3, with fixes also backported to versions as far back as 4.7.

Vulnerability name

Progress LoadMaster Command Injection Vulnerability

Product

Progress LoadMaster

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints

Vulnerability name

JetBrains TeamCity Deserialization of Untrusted Data Vulnerability

Product

JetBrains TeamCity

In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol

Vulnerability name

IBM Langflow Code Injection Vulnerability

Product

IBM Langflow

CVE-2026-9198 is an unauthenticated remote code execution vulnerability affecting IBM Langflow OSS versions 1.0.0 through 1.10.0. This flaw allows attackers to gain full control over default Langflow deployments by exploiting a chain of two API endpoints. Specifically, the vulnerability leverages the `/api/v1/auto_login` endpoint, which issues SUPERUSER tokens to any network caller without requiring authentication. Subsequently, attackers can utilize the `/api/v1/validate/code` endpoint to execute arbitrary Python code via `exec()`, leading to full remote code execution. This issue is classified under CWE-94, indicating improper control of code generation. The vulnerability has been addressed in Langflow version 1.10.1.

Vulnerability name

Apache Tomcat Missing Encryption of Sensitive Data Vulnerability

Product

Apache Tomcat

CVE-2026-34486 is a vulnerability found in Apache Tomcat Tribes, specifically within the `EncryptInterceptor` component responsible for decrypting cluster messages. This issue stems from a regression introduced during a fix for a prior vulnerability, CVE-2026-29146. The regression causes decryption failures to "fail open" rather than "fail closed," meaning that when decryption fails, the original unencrypted or malformed message is still forwarded for processing, bypassing the intended encryption protection. This bypass allows attacker-supplied bytes to reach Tomcat's Java deserialization code path, which utilizes `ObjectInputStream.readObject()` without an `ObjectInputFilter` in the affected flow. Consequently, untrusted serialized objects can be loaded and instantiated. The vulnerability is also described as a "Missing Encryption of Sensitive Data" flaw, enabling the bypass of the `EncryptInterceptor` and potentially exposing sensitive data that should have been encrypted.