4 casos · pág. 1/1
Hacktron analyzes wp2shell, an unauthenticated RCE chain in WordPress core found by Searchlight Cyber. It combines CVE-2026-63030, a route handler confusion in the REST API batch endpoint, with CVE-2026-60137, an SQL injection in WPQuery. Affected versions are WordPress 6.9.0-6.9.4, 7.0.0-7.0.1 and the 7.1 beta, fixed in 6.9.5, 7.0.2 and …
F5 Labs analyzed exploitation of CVE-2026-24423, a CVSS 9.8 unauthenticated remote code execution flaw in SmarterTools SmarterMail (CWE-306). CISA added it to the KEV catalog on February 2, 2026 and notes it has been used in ransomware campaigns. Despite public write-ups, F5 sensors saw only one IP, 193.24.123.58 (ASN 200593, Russian ISP …
CVE-2026-9082 is a critical (CVSS 9.8) pre-authentication SQL injection in the JSON:API module of Drupal Core. It was published on May 20, 2026 and added to the CISA KEV catalog the same month, with a remediation deadline of May 27. F5 sensors recorded 576 exploitation attempts from 9 source IPs between May 20 and May 31, 2026. The earlie…
This SentinelOne weekly roundup (Week 41, 2026) covers law enforcement actions, a phishing campaign and an actively exploited vulnerability. The most urgent item is CVE-2026-21589, a critical (CVSS 9.3) unauthenticated arbitrary file access flaw in Atlassian Data Center products. Exploitation attempts began about two hours after a public …
