CVE-2026-12569

Overview

PTC
Windchill PDMLink

18 Jun 2026

Published

30 Jun 2026

Updated

CVSS v4.0

CRITICAL (9.3)

EPSS

2.26%

MITRE

KEV

Description

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. * This advisory also applies to all CPS versions * The identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030

Statistics

4 Posts

Last activity: 2 hours ago

Fediverse

ThreatNoir @threatnoir

⚠️ CRITICAL: Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE

Cl0p ransomware affiliates are actively exploiting unauthenticated RCE vulnerabilities in internet-exposed PTC Windchill and FlexPLM instances by chaining CVE-2026-12569 with a separate information disclosure flaw. Affected organizations in manufacturing, automotive, aerospace, and retail face data…

https://threatnoir.com/focus

#infosec #cybersecurity

0
0
0
11h ago

Bluesky

ohhara @shiojiri.com

Cl0pのアフィリエイトが認証不要のRCE脆弱性を悪用、露出したPTC WindchillとFlexPLMを標的に（CVE-2026-12569） | Codebook｜Security News https://codebook.machinarecord.com/threatreport/silobreaker-cyber-alert/46859/

0
0
0
13h ago

Information Security Briefly @infosecbriefly.bsky.social

Cl0p affiliates exploit CVE-2026-12569 in PTC Windchill and FlexPLM for unauthenticated RCE, deploying JSP webshells and extorting victims with data theft.

0
0
0
6h ago

Cybersecurity News Everyday @hendryadrian.bsky.social

Cl0p affiliates are exploiting CVE-2026-12569 in PTC Windchill and FlexPLM, chaining flaws to gain RCE, drop JSP webshells, and steal data from aerospace, automotive, manufacturing, and retail firms. #Cl0p #PTC #Windchill

0
0
0
2h ago

CVE-2026-61511

Overview

vBulletin
vBulletin

27 Jul 2026

Published

27 Jul 2026

Updated

CVSS v4.0

CRITICAL (9.3)

EPSS

Pending

MITRE

KEV

Description

vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code by supplying crafted input through the pagenav[pagenumber] parameter. Attackers can exploit the insufficiently restrictive regex filter by using phpfuck-style encoding with permitted characters to inject and execute arbitrary PHP code via the unauthenticated ajax/render template route without any authentication.

Statistics

3 Posts
3 Interactions

Last activity: 2 hours ago

Fediverse

SSD Secure Disclosure @SSDSecureDisclosure

🚨 New advisory was just published!

An independent security researcher working with SSD Secure Disclosure has identified a critical vulnerability in vBulletin that allows an unauthenticated attacker to execute arbitrary code on a remote server. The vulnerability has been assigned CVE-2026-61511. Read our full advisory: https://ssd-disclosure.com/vbulletin-runtime-template-runmaths-preauth-rce/

1
0
0
11h ago

Dark Web Informer :verified_paw: @DarkWebInformer

🚨‼️ CVE-2026-61511: A vulnerability in vBulletin has been identified, the vulnerability allows an unauthenticated user to cause the vBulletin to execute arbitrary code (PHP) on the remote server.

CVSS: 9.8

Exploit: https://ssd-disclosure.com/vbulletin-runtime-template-runmaths-preauth-rce/

0
2
0
2h ago

Daily CyberSecurity @DailyCyberSecurity

A public PoC now targets CVE-2026-61511, a vBulletin preauth RCE via runMaths eval. Patch to vBulletin 6.2.2 to block remote code execution.

#vBulletin #CVE202661511 #RCE #PreauthRCE #RemoteCodeExecution #PoC #WebSecurity #Cybersecurity

https://securityonline.info/vbulletin-preauth-rce-cve-2026-61511/?utm_source=mastodon&utm_medium=jetpack_social

0
0
0
11h ago

CVE-2026-16723

Overview

Alibaba
Fastjson

23 Jul 2026

Published

23 Jul 2026

Updated

CVSS v3.1

CRITICAL (9.0)

EPSS

0.41%

MITRE

KEV

Description

A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.

Statistics

3 Posts

Last activity: 2 hours ago

Fediverse

ThreatNoir @threatnoir

⚠️ CRITICAL: Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available

Attackers are actively exploiting CVE-2026-16723, a critical RCE in Alibaba Fastjson 1.x used by Spring Boot applications. Unauthenticated code execution is possible with Java process privileges. No patch exists for 1.x versions yet.

https://threatnoir.com/focus

#infosec #cybersecurity

0
0
0
11h ago

Bluesky

キタきつね @kitafox.bsky.social

FastJsonのRCE脆弱性CVE-2026-16723が実際に悪用され、詳細とPoCエクスプロイトコードが公開された FastJson RCE CVE-2026-16723 Exploited in the Wild as Details and PoC Exploit Code Go Public #DailyCyberSecurity (Jul 25) securityonline.info/fastjson-rce...

0
0
0
17h ago

CyberVeille @cyberveille-ch.bsky.social

📢 CVE-2026-16723 : RCE dans FastJson 1.2.83 via SSRF et chargement de classe distante 📝 ## 🔍 Contexte Publié le 21 juillet 2026 par la société FearsOff … https://cyberveille.ch/posts/2026-07-27-cve-2026-16723-rce-dans-fastjson-1-2-83-via-ssrf-et-chargement-de-classe-distante/ #AutoType #Cyberveille

0
0
0
2h ago

CVE-2026-64600

Overview

Linux
Linux

23 Jul 2026

Published

27 Jul 2026

Updated

CVSS v3.1

HIGH (7.8)

EPSS

0.49%

MITRE

KEV

Description

In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode, a data fork mapping, and a cow fork mapping. Unfortunately, these two helpers cycle the ILOCK to grab a transaction, which means that the mappings are stale as soon as we reacquire the ILOCK. Currently we refresh the cow fork mapping by re-calling xfs_find_trim_cow_extent, but we don't refresh the data fork mapping beforehand, which means that the xfs_bmap_trim_cow in that function queries the refcount btree about the wrong physical blocks and returns an inaccurate value in *shared. If *shared is now false, the directio write proceeds with a stale data fork mapping. Fix this by querying the data fork mapping if the sequence counter changes across the ILOCK cycle.

Statistics

3 Posts

Last activity: 2 hours ago

Fediverse

benzogaga33 :verified: @benzogaga33

RefluXFS : cette faille dans XFS donne un accès root sur RHEL, CentOS et AlmaLinux https://www.it-connect.fr/refluxfs-cve-2026-64600-faille-xfs-acces-root-linux/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #Linux

0
0
0
10h ago

Bluesky

WarthogTK @warthogtk.bsky.social

RefluXFS: A Linux Kernel Local Privilege Escalation to Root in XFS (CVE-2026-64600) | Qualys blog.qualys.com/vulnerabilit...

0
0
0
9h ago

r/blueteamsec bot @r-blueteamsec.bsky.social

RefluXFS: Local Privilege Escalation via XFS reflink direct-I/O race (CVE-2026-64600)

0
0
0
2h ago

CVE-2026-49176

Overview

Microsoft
Windows 10 Version 1607

14 Jul 2026

Published

27 Jul 2026

Updated

CVSS v3.1

HIGH (7.8)

EPSS

0.40%

MITRE

KEV

Description

Improper privilege management in Windows WalletService allows an authorized attacker to elevate privileges locally.

Statistics

2 Posts

Last activity: 17 hours ago

Fediverse

Daily CyberSecurity @DailyCyberSecurity

CVE-2026-49176 is a Windows WalletService elevation of privilege flaw. Full details and a public PoC exploit are out, so patch Windows now.

#CVE202649176 #WalletService #Windows #PrivilegeEscalation #EoP #PoC #Microsoft

http://securityonline.info/cve-2026-49176-walletservice-eop/?utm_source=mastodon&utm_medium=jetpack_social

0
0
0
18h ago

Bluesky

キタきつね @kitafox.bsky.social

CVE-2026-49176 Windows WalletServiceの特権昇格の脆弱性に対する概念実証（PoC）エクスプロイトが公開される CVE-2026-49176 Windows WalletService Elevation of Privilege Flaw Gets Public PoC Exploit #DailyCyberSecurity (Jul 27) securityonline.info/cve-2026-491...

0
0
0
17h ago

CVE-2026-63030

Overview

WordPress
WordPress

17 Jul 2026

Published

22 Jul 2026

Updated

CVSS v3.1

CRITICAL (9.8)

EPSS

98.05%

MITRE

KEV

Description

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.

Statistics

2 Posts
29 Interactions

Last activity: 3 hours ago

Fediverse

stux⚡️ @stux

Holy shit

wp2shell (CVE-2026-63030 & CVE-2026-60137) - full RCE chain

" Independent proof-of-concept for the unauthenticated WordPress REST batch route-confusion SQL injection associated with Searchlight Cyber's wp2shell advisory."

https://github.com/Icex0/wp2shell-poc

#WordPress #RCE

17
12
0
6h ago

Bluesky

technews4869 @technews4869.bsky.social

piyolog.hatenadiary.jp/ent... WordPress Coreの脆弱性 CVE-2026-63030 / CVE-2026-60137 (通称「wp2shell」)についてまとめてみた - piyolog

0
0
0
3h ago

CVE-2026-60137

Overview

WordPress
WordPress

17 Jul 2026

Published

22 Jul 2026

Updated

CVSS v3.1

MEDIUM (5.9)

EPSS

77.97%

MITRE

KEV

Description

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.

Statistics

2 Posts
29 Interactions

Last activity: 3 hours ago

Fediverse

stux⚡️ @stux

Holy shit

wp2shell (CVE-2026-63030 & CVE-2026-60137) - full RCE chain

" Independent proof-of-concept for the unauthenticated WordPress REST batch route-confusion SQL injection associated with Searchlight Cyber's wp2shell advisory."

https://github.com/Icex0/wp2shell-poc

#WordPress #RCE

17
12
0
6h ago

Bluesky

technews4869 @technews4869.bsky.social

piyolog.hatenadiary.jp/ent... WordPress Coreの脆弱性 CVE-2026-63030 / CVE-2026-60137 (通称「wp2shell」)についてまとめてみた - piyolog

0
0
0
3h ago

CVE-2026-46331

Overview

Linux
Linux

16 Jun 2026

Published

23 Jul 2026

Updated

CVSS v3.1

HIGH (7.8)

EPSS

0.52%

MITRE

KEV

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.

Statistics

1 Post
1 Interaction

Last activity: 6 hours ago

Bluesky

/r/netsec @r-netsec-bot.bsky.social

Escaping Claude Cowork’s local VM sandbox via CVE-2026-46331

1
0
0
6h ago

CVE-2026-64606

Overview

Apache Software Foundation
Apache Fory
org.apache.fory:fory-core

21 Jul 2026

Published

21 Jul 2026

Updated

CVSS

Pending

EPSS

0.53%

MITRE

KEV

Description

Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lambda deserialization. Only lambda capture class is affected This issue affects Apache Fory: from before 1.4.0. Users are recommended to upgrade to version 1.4.0, which fixes the issue.

Statistics

1 Post
1 Interaction

Last activity: 6 hours ago

Fediverse

Daily CyberSecurity @DailyCyberSecurity

Apache Fory vulnerabilities hit Java, C++, and Rust deserialization, including CVE-2026-64606. Upgrade to Fory 1.4.0 to fix all four flaws.

#ApacheFory #Deserialization #Java #Rust #Cpp #Vulnerability #OpenSource #Cybersecurity

https://securityonline.info/apache-fory-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

0
1
0
6h ago

CVE-2026-57990

Overview

Microsoft
Microsoft Edge (Chromium-based)

26 Jul 2026

Published

27 Jul 2026

Updated

CVSS v3.1

HIGH (7.4)

EPSS

Pending

MITRE

KEV

Description

Files or directories accessible to external parties in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.

Statistics

1 Post
1 Interaction

Last activity: 20 hours ago

Fediverse

Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-57990 - High-severity information disclosure in Microsoft Edge (Chromium). Unauthorized access to files over network. CVSS 7.4. No patch yet—restrict network access. #CVE #Microsoft #edge

https://www.valtersit.com/cve/CVE-2026-57990/

0
1
0
20h ago