1dayexploit

CVE-2018-1160 Exploit: Netatalk OOB Write RCE

Tue, 06 Oct 2026 02:00:00 GMT

CVE-2018-1160: Netatalk out-of-bounds write RCE affecting AFP/DSI daemon before 3.1.12. Unauthenticated remote code execution via oversized ATTNQUANT option.

CVE-2026-65008 Exploit: Grav CMS RCE

Tue, 06 Oct 2026 02:00:00 GMT

CVE-2026-65008 (Grav CMS 2.0.4): authenticated page write to unauthenticated remote code execution via unguarded call_user_func_array() in Blueprint::dynamicData().

CVE-2026-19949 Exploit: AIOWM Pre-Auth SQLi

Fri, 25 Sep 2026 00:39:00 GMT

CVE-2026-19949: All-in-One WP Migration unauthenticated SQL injection via boundary-flip on archive restore, leaks ai1wm_secret_key and RCE. CVSS 8.8 (HIGH).

CVE-2026-87902 Exploit: WordPress Path Traversal RCE

Thu, 24 Sep 2026 15:30:00 GMT

CVE-2026-87902 is an unauthenticated WordPress path traversal enabling arbitrary local PHP file inclusion, chainable to remote code execution via the PEAR gadget.

CVE-2026-65634 Exploit: Erlang/OTP OID DoS

Tue, 22 Sep 2026 16:30:00 GMT

CVE-2026-65634: Erlang/OTP OBJECT IDENTIFIER decoder quadratic-complexity DoS in X.509 parsing - remote pre-auth denial of service

CVE-2026-60004 Exploit: Gitea RCE via Hook

Tue, 22 Sep 2026 14:30:00 GMT

CVE-2026-60004: Gitea pre-auth RCE via diffpatch API and Git hook installation. Versions 1.17.0-1.27.0 affected, fixed in 1.27.1.

CVE-2026-53940 Exploit: Conda Entry-Point RCE

Tue, 22 Sep 2026 14:00:00 GMT

CVE-2026-53940: Conda entry-point path traversal allows arbitrary file write and remote code execution through malicious noarch:python packages

CVE-2026-37266 Exploit: Responsive FileManager RCE

Thu, 17 Sep 2026 14:30:00 GMT

CVE-2026-37266: Responsive FileManager remote code execution via arbitrary file creation and path traversal bypass. Pre-auth RCE on versions <= 9.14.0.

CVE-2026-78159 Exploit: Events Calendar RCE

Tue, 15 Sep 2026 18:30:00 GMT

CVE-2026-78159: Events Calendar pre-auth RCE via PHP type confusion in Element_Classes::parse_array(), unauthenticated. CVSS 9.8.

CVE-2026-85706 Exploit: GitLab Arbitrary File Read

Tue, 15 Sep 2026 16:35:00 GMT

Unauthenticated arbitrary file read in GitLab CE/EE (CVE-2026-85706) via Workhorse-Grape parser differential and missing auth check. Affects 18.7-19.3. CVSS 10.0.

CVE-2026-78006 Exploit: Events Calendar RCE

Tue, 15 Sep 2026 16:30:00 GMT

CVE-2026-78006: The Events Calendar 6.17.4 PHP object injection to unauthenticated RCE via stored comments in WordPress.

CVE-2026-84647 Exploit: Jenkins Stapler Type Confusion

Fri, 11 Sep 2026 14:30:00 GMT

CVE-2026-84647: Jenkins Stapler unsafe type instantiation lets authenticated users (Overall/Read) execute arbitrary constructors inside the controller JVM via form binding type confusion.

CVE-2026-86730 Exploit: Craft CMS Auth RCE

Thu, 10 Sep 2026 14:30:00 GMT

CVE-2026-86730 is an authenticated RCE in Craft CMS 5.0.0-RC1 through 5.10.11 via Yii2 behavior injection in field-layout configuration.

CVE-2026-75816 Exploit: Frontend Admin Auth Bypass

Wed, 09 Sep 2026 14:30:00 GMT

CVE-2026-75816 - Frontend Admin: unauthenticated authentication bypass leading to admin account takeover via broken access control in form submission handlers.

CVE-2026-83627 Exploit: Hummingbird RCE via Log

Tue, 08 Sep 2026 14:00:00 GMT

CVE-2026-83627 is an unauthenticated remote code execution in the Hummingbird WordPress plugin via poisoning the page-cache debug log into arbitrary PHP execution.

CVE-2026-16723 Exploit: fastjson RCE

Tue, 08 Sep 2026 10:30:00 GMT

CVE-2026-16723: fastjson 1.x unauthenticated RCE via unsafe class resolution. Remote code execution with no AutoType enablement or gadget chain required.

CVE-2026-6377 Exploit: Next4Biz CSM Path Traversal

Mon, 07 Sep 2026 18:45:00 GMT

CVE-2026-6377: unauthenticated path traversal in Next4Biz CSM. One GET request to DownloadFileHandler.ashx reads any file the app pool can open (CVSS 8.6)

CVE-2026-59313: Spring Framework - SSE CR/LF Injection

Mon, 07 Sep 2026 15:47:00 GMT

CVE-2026-59313 affects Spring Framework versions up to 7.0.8, allowing CR/LF injection into Server-Sent Events streams. An attacker can forge entire events to be received by other stream users.

CVE-2025-55182: React2Shell Pre-Auth RCE

Mon, 07 Sep 2026 14:30:00 GMT

React2Shell (CVE-2025-55182): Pre-auth RCE via insecure deserialization in React Server Components. CVSS 10.0 critical.

CVE-2026-55634: Pimcore - DataObject PHP Injection RCE

Mon, 07 Sep 2026 02:30:00 GMT

CVE-2026-55634: Pimcore DataObject field-name PHP code injection and SQL identifier injection (CWE-94 + CWE-89). Unauthenticated RCE via class definition import, CVSS 9.9.