vendors:Microsoft × has_exploit:true × criticity:critical × limpar

Resultados

2 casos · pág. 1/1

hacktron.ai · há 2d · 2 fontes · 2 atualizações exploit público critical

wp2shell: WordPress core REST batch route confusion (CVE-2026-63030) and WP_Query SQLi (CVE-2026-60137) chain into unauthenticated RCE

Hacktron analyzes wp2shell, an unauthenticated RCE chain in WordPress core found by Searchlight Cyber. It combines CVE-2026-63030, a route handler confusion in the REST API batch endpoint, with CVE-2026-60137, an SQL injection in WPQuery. Affected versions are WordPress 6.9.0-6.9.4, 7.0.0-7.0.1 and the 7.1 beta, fixed in 6.9.5, 7.0.2 and …

CVE-2026-63030 CVE-2026-60137 CVE-2018-14028

thehackernews.com · há 2d exploit público critical

Weekly Recap: BeyondTrust 0-day by Armory Castle, Ledger supply-chain implants, French refrigeration attacks, ConnectWise breach

This weekly recap covers several concurrent incidents. ConnectWise disabled seven application identities and suspended Cloud Backup after unknown actors abused them to compromise Microsoft 365 tenants. China-nexus Armory Castle (UNC5221 / Warp Panda) exploited BeyondTrust Remote Support flaw CVE-2026-102764 (CVSS 9.3) as a zero-day in lat…

CVE-2026-102764 CVE-2026-110447 CVE-2021-36260 Armory Castle UNC5221 retail technology