tag
Unauth-Rce
Netflix Conductor Unauthenticated RCE via INLINE GraalVM Evaluator — CVE-2026-58138
Conductor evaluates user-supplied JavaScript (and Python) expressions in INLINE (and related LAMBDA/DOWHILE/SWITCH) workflow tasks using a GraalVM polyglot context built with full host access (HostAccess.ALL / allowAllAccess(true)). Because the community REST…
Joomla Page Builder CK Unauthenticated Arbitrary File Upload RCE — CVE-2026-56290
The Joomla extension Page Builder CK exposes a controller method, browse.ajaxAddPicture, that accepts file uploads with a user-controlled destination path parameter (path) that is only passed through trim() — no whitelist, extension check, or…
Feast Registry gRPC Unauthenticated RCE via dill.loads — CVE-2026-56121
Feast's registry gRPC server deserializes the user-defined function (UDF) body of an OnDemandFeatureView with dill.loads() (a pickle superset) the moment a spec is received via the ApplyFeatureView RPC — before any permission check runs. Because the default…
Control Web Panel Pre-Auth Blind SQL Injection to RCE — CVE-2026-57517
Control Web Panel versions <= 0.9.8.1224 contain a pre-authentication blind SQL injection in the userRes POST parameter of the user panel endpoint (/{username}/). The backend query runs with MySQL root privileges, which hold the global FILE privilege,…
Ubiquiti UniFi OS Unauthenticated RCE Chain (CVE-2026-34908 / CVE-2026-34909 / CVE-2026-34910)
A three-CVE unauthenticated RCE chain in Ubiquiti UniFi OS Server ≤ 5.0.6 allows a remote attacker to achieve root-level command execution with no credentials. CVE-2026-34908 and CVE-2026-34909 (improper access control + path traversal) are chained to bypass…