RCE

P Paraschivoiu Alexandru · Sep 9, 2026 · 20 min

CVE-2026-85978: how one path normalization mismatch turned Akana's admin console into unauthenticated remote code execution

Inside CVE-2026-85978: a path normalization gap between Akana Policy Manager's auth filter and its servlet dispatcher lets an unauthenticate...

S Stefan Mitocaru · Jul 31, 2026 · 19 min

CVE-2026-63223: how a GIF header on a PHP file turned CodeIgniter's image upload check into remote code execution

CodeIgniter's is_image and mime_in upload rules trusted content-derived MIME type but never the client filename extension, letting a .php fi...

P Paraschivoiu Alexandru · Jul 20, 2026 · 21 min

CVE-2026-60137 + CVE-2026-63030: how a one-position array desync in WordPress's batch API turned a login-only SQL injection into unauthenticated RCE

Inside wp2shell (CVE-2026-60137 + CVE-2026-63030): a REST batch route desync in WordPress core unblocks an author__not_in SQL injection, cha...

P Paraschivoiu Alexandru · Jul 17, 2026 · 19 min

CVE-2026-58644: how one unsafe deserialize turns an on-prem SharePoint server into unauthenticated remote code execution

Inside CVE-2026-58644: a critical (CVSS 9.8) deserialization flaw in on-premises Microsoft SharePoint Server that hands unauthenticated atta...

S Stefan Mitocaru · Jul 10, 2026 · 22 min

IonStack (CVE-2026-10702 + CVE-2026-43499): how a JIT miscompilation and a 15-year-old kernel flaw turned one URL click into full Android 17 root

Inside IonStack: Nebula Security chains a Firefox IonMonkey type-confusion (CVE-2026-10702) with a 15-year-old Linux kernel stack-UAF (CVE-2...

S Stefan Mitocaru · Jun 15, 2026 · 16 min

CVE-2026-20253: how a localhost-only database helper turned every AWS Splunk box into a pre-auth RCE

Inside CVE-2026-20253 (CVSS 9.8): Splunk Enterprise's PostgreSQL backup sidecar trusted the network instead of the request, letting an unaut...

P Paraschivoiu Alexandru · Jun 8, 2026 · 16 min

CVE-2026-20245: how a tenant-list CSV upload turned Cisco SD-WAN Manager into a root shell

Inside CVE-2026-20245: an unvalidated file-path argument to a privileged tenant-list upload script lets a netadmin execute commands as root...

P Paraschivoiu Alexandru · Jun 3, 2026 · 18 min

CVE-2026-45659: how an ordinary site member turns on-prem SharePoint into a remote code execution box

Inside CVE-2026-45659: an insecure-deserialization (CWE-502) flaw lets any authenticated SharePoint Server Site Member run code on-prem (CVS...

P Paraschivoiu Alexandru · Jun 2, 2026 · 17 min

CVE-2026-48095: how a 1-byte heap buffer turned 7-Zip's NTFS parser into an extension-agnostic code execution primitive

Inside CVE-2026-48095: an undefined-behavior shift in 7-Zip's NTFS handler allocates a 1-byte buffer, then writes 256 MB into it, corrupting...

S Stefan Mitocaru · May 20, 2026 · 16 min

CVE-2026-6973: Ivanti EPMM RCE Actively Exploited in the Wild and Already in CISA KEV

Ivanti Ivanti Endpoint Manager Mobile (versions up to 12.8.0.0) contains an improper input validation vulnerability that allows remote code...

P Paraschivoiu Alexandru · May 18, 2026 · 22 min

CVE-2026-42945: how an 18-year-old flaw in NGINX's rewrite module turned the world's most popular web server into a one-shot RCE target

Inside CVE-2026-42945 (NGINX Rift): the 18-year-old heap buffer overflow in NGINX's ngx_http_rewrite_module that enables unauthenticated RCE...

P Paraschivoiu Alexandru · May 13, 2026 · 15 min

CVE-2026-23918: Apache HTTP/2 Double-Free Flaw That Can Bring Down Your Server (and Worse)

A critical double-free bug in Apache HTTP Server 2.4.66 lets unauthenticated attackers crash worker processes with two HTTP/2 frames, and es...