/
latest_source_host:hacktron.ai × criticity:critical × limpar

Resultados

3 casos · pág. 1/1

hacktron.ai · critical

Pre-auth RCE CVE-2026-1731 (CVSS 9.9) in BeyondTrust Remote Support and older Privileged Remote Access

Hacktron AI disclosed CVE-2026-1731, a critical (CVSS 9.9) pre-authentication remote code execution vulnerability in BeyondTrust Remote Support (RS) and older versions of Privileged Remote Access (PRA). An unauthenticated remote attacker could run operating system commands in the context of the site user. Hacktron found the flaw through A…

CVE-2026-1731 healthcare financial services
hacktron.ai · exploit público critical

Pre-auth RCE in OpenAM via jato.clientSession unsafe deserialization (CVE-2026-33439)

Hacktron AI researchers disclosed CVE-2026-33439 (CVSS 9.8, CWE-502), an unauthenticated remote code execution flaw in OpenIdentityPlatform OpenAM 16.0.5 and earlier. It is a variant of CVE-2021-35464: the earlier fix whitelisted deserialization for the jato.pageSession parameter but left the sibling jato.clientSession parameter unfiltere…

CVE-2026-33439 CVE-2021-35464
hacktron.ai · · 2 fontes · 2 atualizações exploit público critical

wp2shell: WordPress core REST batch route confusion (CVE-2026-63030) and WP_Query SQLi (CVE-2026-60137) chain into unauthenticated RCE

Hacktron analyzes wp2shell, an unauthenticated RCE chain in WordPress core found by Searchlight Cyber. It combines CVE-2026-63030, a route handler confusion in the REST API batch endpoint, with CVE-2026-60137, an SQL injection in WPQuery. Affected versions are WordPress 6.9.0-6.9.4, 7.0.0-7.0.1 and the 7.1 beta, fixed in 6.9.5, 7.0.2 and …

CVE-2026-63030 CVE-2026-60137 CVE-2018-14028