CWE-94

WordPress — Pre-Auth XSS to RCE Chain via Login Page Parser Differential (CVE-2026-64638, "XSS2Shell") new EPSS 31%CVE-2026-64638webHIGH 8.9Unverified2026-08-09Gitea — diffpatch API Git Hook Remote Code Execution (CVE-2026-60004) new KEV EPSS 85%CVE-2026-60004webHIGH 8.8Patched2026-08-09IBM Langflow OSS Unauthenticated RCE via Auto-Login + validate/code Chain (CVE-2026-9198) new KEV EPSS 35%CVE-2026-9198webCRITICAL 9.8Patched2026-07-31LLaMA-Factory WebUI Remote Code Execution via Hardcoded `trust_remote_code` (CVE-2026-58116) newCVE-2026-58116webCRITICAL 9.8Patched2026-07-19XWiki SolrSearch Macro Unauthenticated Groovy RCE (CVE-2025-24893) new KEV EPSS 100%CVE-2025-24893webCRITICAL 9.8Patched2026-07-06Wing FTP Server NULL-Byte Lua Injection Unauthenticated RCE (CVE-2025-47812) new KEV EPSS 93%CVE-2025-47812webCRITICAL 10Patched2026-07-06Sneeit Framework <= 8.3 Unauthenticated RCE via `call_user_func()` — Rogue Admin Creation (CVE-2025-6389) new EPSS 76%CVE-2025-6389webCRITICAL 9.8Unverified2026-07-06Oracle Identity Manager `;.wadl` Authentication Bypass + Groovy Script RCE (CVE-2025-61757) new KEV EPSS 88%CVE-2025-61757webCRITICAL 9.8Unpatched2026-07-06Mongoose `populate()` Match `$where` Bypass Command Injection (CVE-2025-23061) newCVE-2025-23061webCRITICAL 9Patched2026-07-06Invision Community Theme Editor Template Injection Unauthenticated RCE (CVE-2025-47916) new EPSS 84%CVE-2025-47916webCRITICAL 10Patched2026-07-06IngressNightmare: Kubernetes ingress-nginx Admission Controller Shared-Library Injection RCE (CVE-2025-1974) new EPSS 100%CVE-2025-1974cloudCRITICAL 9.8Unverified2026-07-06Flowise CustomMCP Unauthenticated Remote Code Execution via Function() Constructor (CVE-2025-59528) new EPSS 87%CVE-2025-59528webCRITICAL 10Patched2026-07-06DataEase PostgreSQL JDBC Datasource-Validation Bypass to Remote Code Execution (CVE-2025-49002) new EPSS 47%CVE-2025-49002webCRITICAL 9.8Patched2026-07-06ACF Extended (ACFE) `prepare_form()` Unauthenticated RCE via Privilege Escalation (CVE-2025-13486) new EPSS 68%CVE-2025-13486webCRITICAL 9.8Unverified2026-07-06Spring AI SimpleVectorStore SpEL Injection RCE (CVE-2026-22738) newCVE-2026-22738webCRITICAL 9.8Patched2026-07-05Shopware Twig Rendered-View Code Injection Regression (CVE-2026-23498) newCVE-2026-23498webHIGHPatched2026-07-05PbootCMS Authenticated RCE via sitecopyright Field (CVE-2026-36239) newCVE-2026-36239webCRITICALUnverified2026-07-05OpenWebUI "Tools" Unsandboxed exec() Remote Code Execution — CVE-2026-0766 new EPSS 26%CVE-2026-0766webHIGH 8.8Unverified2026-07-05Kanboard — Missing Access Control on Plugin Installation Leads to Administrative RCE via Webshell Plugin (CVE-2026-25924) newCVE-2026-25924 / GHSA-grch-p7vf-vc4fwebHIGH 8.4Patched2026-07-05DbGate Unauthenticated RCE via JSON Script Runner (CVE-2026-47668) newCVE-2026-47668webCRITICAL 3.1Patched2026-07-05DbGate `loadReader` `functionName` Injection RCE (CVE-2026-48017) newCVE-2026-48017 / GHSA-hv83-ggc4-v385webHIGH 8.8Patched2026-07-05Avada Builder Unauthenticated RCE via call_user_func() Allowlist Bypass (CVE-2026-6279) newCVE-2026-6279webCRITICALUnverified2026-07-05