CVE-2026-64638

Overview

WordPress
WordPress

07 Aug 2026

Published

07 Aug 2026

Updated

CVSS v4.0

HIGH (8.9)

EPSS

0.77%

MITRE

KEV

Description

WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim. This issue affects all versions of WordPress. Version 7.0.3 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7. Discovered and responsibly disclosed by [the team at pwn.ai](https://pwn.ai/).

Statistics

4 Posts
12 Interactions

Last activity: 1 hour ago

Fediverse

Catalin Cimpanu @campuscodi

Another one of those WordPress pre-auth RCEs

This one's named XSS2Shell, CVE-2026-64638, found with AI, patched in v7.0.3, released on Thursday

https://pwn.ai/blog/xss2shell

7
5
1
14h ago

:mastodon: decio @decio

Dans la suite de wp2shell, encore une jolie chaîne WordPress : #XSS2Shell — CVE-2026-64638.

Au départ, on a “juste” une Reflected XSS pré-auth sur wp-login.php.

Sauf qu’en la chaînant avec plusieurs briques déjà présentes dans WordPress, on arrive à quelque chose de beaucoup moins sympa :

XSS → contexte admin → Application Password → REST API → upload de plugin → RCE 🐚

⚠️ À noter quand même : ce n’est pas du pre-auth zero-click.
Il faut qu’un admin déjà connecté clique sur un lien contrôlé par l’attaquant.

Encore un bon rappel : une “simple XSS” peut devenir franchement méchante une fois mise dans la bonne chaîne.

🩹 Corrigé dans WordPress 7.0.3.
👇
https://wordpress.org/news/2026/08/wordpress-7-0-3-release/

En cas de doute sur une exploitation passée : petit coup d’œil aux Application Passwords, aux plugins récemment ajoutés et aux fichiers PHP inhabituels.

"XSS2Shell: WordPress Preauth XSS to RCE Chain (CVE-2026-64638)"
👇
https://pwn.ai/blog/xss2shell

#WordPress #XSS2Shell #CyberVeille

0
0
0
1h ago

Bluesky

ohhara @shiojiri.com

XSS2Shell：WordPressの新たな脆弱性がPHPコード実行につながる恐れ（CVE-2026-64638） | Codebook｜Security News https://codebook.machinarecord.com/threatreport/silobreaker-cyber-alert/47150/

0
0
0
3h ago

CVE-2026-64564

Overview

Linux
Linux

04 Aug 2026

Published

09 Aug 2026

Updated

CVSS v3.1

CRITICAL (9.8)

EPSS

0.48%

MITRE

KEV

Description

In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctp_process_asconf() caches the transport the ASCONF chunk is processed against in asconf->transport (== chunk->transport, set once in sctp_rcv()). For an ASCONF located through its Address Parameter by __sctp_rcv_asconf_lookup(), that cached transport corresponds to the Address Parameter, which need not be the packet's source address. sctp_process_asconf_param() rejects a DEL-IP for the packet source address (ADDIP D8, SCTP_ERROR_DEL_SRC_IP), but nothing protects asconf->transport. A single ASCONF can therefore carry, in order: [Address Parameter L] [DEL-IP L] [DEL-IP 0.0.0.0] where L differs from the source. The DEL-IP for L passes the D8 check and calls sctp_assoc_rm_peer() on the transport that asconf->transport still points at, freeing it (RCU-deferred). The following wildcard DEL-IP then reuses the now-dangling asconf->transport in sctp_assoc_set_primary() and sctp_assoc_del_nonprimary_peers(): set_primary() dereferences the freed transport (->ipaddr, ->state) and plants the dangling pointer into asoc->peer.primary_path / active_path, and del_nonprimary_peers(), keeping only the pointer that is no longer on the list, removes every real transport, leaving the association with a transport_count of 0 and primary_path/active_path pointing at freed memory. Reject a DEL-IP that targets the transport the ASCONF is being processed against, mirroring the existing source-address guard, so the wildcard branch can never reuse a freed transport.

Statistics

3 Posts
16 Interactions

Last activity: 8 hours ago

Fediverse

Linuxiac @linuxiac

The SCTPhantom vulnerability, CVE-2026-64564, affects Linux SCTP code and can be exploited for root access and container escape.
https://linuxiac.com/18-year-old-linux-kernel-vulnerability-enables-root-access-and-container-escape/

#linux #kernel #opensource #security

3
6
0
22h ago

Daily CyberSecurity @DailyCyberSecurity

CVE-2026-64564: SCTP Flaw Enables Container Escape

https://securityonline.info/sctp-uaf-cve-2026-64564-container-escape/?utm_source=mastodon&utm_medium=jetpack_social

0
0
0
8h ago

Bluesky

Linuxiac @linuxiac.bsky.social

The SCTPhantom vulnerability, CVE-2026-64564, affects Linux SCTP code and can be exploited for root access and container escape. linuxiac.com/18-year-old-... #Linux #Kernel #OpenSource #Security

0
7
0
22h ago

CVE-2026-71987

Overview

MSI
Radix AXE6600

08 Aug 2026

Published

08 Aug 2026

Updated

CVSS v4.0

CRITICAL (9.3)

EPSS

1.35%

MITRE

KEV

Description

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the alg function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the alg function to execute malicious commands and obtain root privileges on the underlying system.

Statistics

2 Posts
1 Interaction

Last activity: 17 hours ago

Fediverse

Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-71987 - Critical unpatched RCE in MSI Radix AXE6600 routers via command injection in alg function. CVSS 9.8. Full root access possible. Update immediately or isolate devices. #CVE #MSI #infosec

https://www.valtersit.com/cve/CVE-2026-71987/

0
1
0
17h ago

OffSequence @offseq

CVE-2026-71987: MSI Radix AXE6600 (v781521) suffers from a CRITICAL OS command injection vulnerability (CVSS 9.3). Remote, unauthenticated code execution possible with root privileges. Restrict device access and monitor! https://radar.offseq.com/threat/cve-2026-71987-improper-neutralization-of-special-elements-used-in-an-os-command-os-command-injection-46b78b0439cf6545 #OffSeq #CVE202671987 #Infosec #RouterSecurity

0
0
0
23h ago

CVE-2026-8037

Overview

Progress Software
LoadMaster

04 Jun 2026

Published

08 Aug 2026

Updated

CVSS v3.1

CRITICAL (9.6)

EPSS

99.31%

MITRE

KEV

Description

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints

Statistics

2 Posts

Last activity: Last hour

Fediverse

CyberNetsecIO @netsecio

📰 CISA Adds Progress Kemp LoadMaster Flaw to KEV Catalog After Exploits

🚨 CISA KEV ALERT: A critical command injection flaw in Progress Kemp LoadMaster (CVE-2026-8037, CVSS 9.6) is actively exploited. Unauthenticated attackers can gain full control. Federal agencies must patch by Aug 10. #CVE #CISA #KEV #PatchNow

🔗 https://cyber.netsecops.io/articles/progress-kemp-loadmaster-flaw-cve-2026-8037-added-to-cisa-kev-catalog/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

0
0
0
16h ago

Bluesky

Information Security Briefly @infosecbriefly.bsky.social

CISA urged immediate patching of Progress Kemp LoadMaster CVE-2026-8037, a critical unauthenticated OS command injection exploited in the wild for root-level RCE.

0
0
0
Last hour

CVE-2026-63077

Overview

JetBrains
TeamCity

27 Jul 2026

Published

06 Aug 2026

Updated

CVSS v3.1

CRITICAL (9.8)

EPSS

1.01%

MITRE

KEV

Description

In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol

Statistics

2 Posts

Last activity: Last hour

Fediverse

Daily CyberSecurity @DailyCyberSecurity

CVE-2026-63077: TeamCity RCE Exploited in the Wild

http://securityonline.info/cve-2026-63077-teamcity-rce-exploited/?utm_source=mastodon&utm_medium=jetpack_social

0
0
0
9h ago

halil deniz @halildeniz

🚨 CRITICAL ADVISORY: Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077). Attackers exploit flawed XStream deserialization under /app/agents/v1/ to execute arbitrary commands. Patch immediately!

https://denizhalil.com/2026/08/10/cve-2026-63077-jetbrains-teamcity-rce-analysis/

#CyberSecurity #RCE #DevSecOps

0
0
0
Last hour

CVE-2026-19389

Overview

Red Hat
Red Hat Enterprise Linux 10
gstreamer1-plugins-ugly-free

10 Aug 2026

Published

10 Aug 2026

Updated

CVSS

Pending

EPSS

Pending

MITRE

KEV

Description

Multiple integer overflow and underflow vulnerabilities were found in the GStreamer gst-plugins-ugly ASF demuxer (asfdemux) when parsing header objects from crafted ASF, WMV, or WMA files. Insufficient validation of attacker-controlled length and size values can bypass bounds checks and cause out-of-bounds heap reads. This can result in application crash, denial of service, or limited information disclosure when untrusted media is processed.

Statistics

1 Post
1 Interaction

Last activity: 5 hours ago

Fediverse

OffSequence @offseq

GStreamer gst-plugins-ugly (asfdemux) in Red Hat Enterprise Linux 10 is affected by CVE-2026-19389 (HIGH, CVSS 7.1). Parsing crafted ASF/WMV/WMA files may lead to DoS or info leaks. No patch yet — avoid untrusted media. https://radar.offseq.com/threat/cve-2026-19389-integer-overflow-or-wraparound-in-red-hat-red-hat-enterprise-linux-10-8bd45ea7a574114c #OffSeq #Linux #CVE #GStreamer

1
0
0
5h ago

CVE-2026-62296

Overview

hapifhir
org.hl7.fhir.core

07 Aug 2026

Published

07 Aug 2026

Updated

CVSS v3.1

HIGH (7.5)

EPSS

0.28%

MITRE

KEV

Description

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, XhtmlParser.java imposes no maximum element nesting depth, so a deeply nested text.div narrative triggers unbounded recursion between parseElementInner() and parseElement(), raising a StackOverflowError. An attacker who can submit FHIR resources containing such narratives can thus crash a parsing or validation worker thread, affecting validator services and any application that parses attacker-supplied FHIR JSON or XML. This issue is fixed in version 6.9.11.

Statistics

1 Post
1 Interaction

Last activity: 22 hours ago

Fediverse

Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-62296 - DoS in HAPI FHIR via deeply nested XHTML. Unbounded recursion crashes parser threads. CVSS 7.5. Fixed in 6.9.11. Update now. #CVE #HAPI #infosec

https://www.valtersit.com/cve/CVE-2026-62296/

0
1
0
22h ago

CVE-2026-14526

Overview

wupsales
AI Copilot – Content Generator

08 Aug 2026

Published

08 Aug 2026

Updated

CVSS v3.1

CRITICAL (9.8)

EPSS

0.61%

MITRE

KEV

Description

The AI Copilot – Content Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to create a new administrator-level user account and achieve full site takeover by saving and executing a malicious workflow containing a wp_create_user action node specifying role=administrator. This vulnerability is exploitable by unauthenticated attackers on any site where the [aiwu-form] shortcode or public chatbot is rendered on a frontend page, as the waic-nonce value is emitted into publicly accessible JavaScript (WAIC_DATA.waicNonce) on those pages, rendering the nonce check a non-functional authorization barrier.

Statistics

1 Post
1 Interaction

Last activity: 15 hours ago

Fediverse

Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-14526 - Critical auth bypass in AI Copilot WordPress plugin. Unauthenticated attackers can create admin accounts and take over sites. CVSS 9.8. Unpatched. Disable plugin now. #CVE #WordPress #infosec

https://www.valtersit.com/cve/CVE-2026-14526/

0
1
0
15h ago

CVE-2026-71947

Overview

D-Link Corporation
DWR-M961

08 Aug 2026

Published

08 Aug 2026

Updated

CVSS v4.0

CRITICAL (9.3)

EPSS

2.09%

MITRE

KEV

Description

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formTracerouteDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host and ipVer fields, resulting in command execution with root privileges.

Statistics

1 Post
1 Interaction

Last activity: 20 hours ago

Fediverse

Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-71947 - Critical command injection in D-Link DWR-M961 routers. Remote attackers can execute arbitrary commands as root via /boafrm/formTracerouteDiagnosticRun. CVSS 9.8. No patch available - isolate affected devices now. #CVE #DLink #infosec

https://www.valtersit.com/cve/CVE-2026-71947/

0
1
0
20h ago

CVE-2026-56793

Overview

Dell
OpenManage Server Administrator Managed Node (Patch) for Windows

07 Aug 2026

Published

08 Aug 2026

Updated

CVSS v3.1

HIGH (7.7)

EPSS

0.31%

MITRE

KEV

Description

Dell OpenManage Server Administrator, versions prior to 11.1.0.2, contains an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.

Statistics

1 Post
1 Interaction

Last activity: 19 hours ago

Fediverse

Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-56793 - High-severity improper authentication in Dell OpenManage Server Administrator (<11.1.0.2). Remote unauthenticated attackers can gain unauthorized access. CVSS 7.7. Update immediately. #CVE #Dell #infosec

https://www.valtersit.com/cve/CVE-2026-56793/

0
1
0
19h ago