#rce

3 analyses tagged rce, sorted newest first.

critical 4 sources
Widget Factory Joomla Content Editor CVE-2026-48907: KEV Unauthenticated Profile Upload to PHP RCE
CISA added CVE-2026-48907 to KEV on 2026-06-16. JCE 2.9.99[.]5 and 2.9.99[.]6 fix an unauthenticated editor-profile upload flaw that can lead to PHP code execution on Joomla sites.

#joomla #php #cisa-kev #rce #web-app

2026-06-16
critical 3 sources
Oracle PeopleSoft CVE-2026-35273: KEV SSRF-to-RCE Zero-Day Exploitation
CISA added actively exploited Oracle PeopleSoft PeopleTools CVE-2026-35273 to KEV on 2026-06-12. Affects PSEMHUB in versions 8.61 and 8.62, allowing unauthenticated remote code execution exploited by ShinyHunters.

#oracle #peoplesoft #peopletools #cisa-kev #rce #shinyhunters #zero-day

2026-06-12
critical 5 sources
Ivanti Sentry CVE-2026-10520: KEV Pre-Auth OS Command Injection
CISA and Ivanti confirmed active exploitation of CVE-2026-10520, a critical pre-authentication OS command injection vulnerability in Ivanti Sentry. Attackers can execute arbitrary commands with root privileges by sending a crafted HTTP POST request to Sentry MICS APIs.

#ivanti #sentry #cisa-kev #rce #command-injection

2026-06-11