CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
WordPress REST API Route Confusion and SQL Injection Chaining Remote Code Execution Vulnerability (CVE-2026-63030)
[Affected Scope] WordPress versions 6.9.x before 6.9.5, and 7.0.x before 7.0.2
[Impact] Unauthenticated attackers can exploit a REST API batch endpoint route confusion vulnerability, chaining it with the WP_Query SQL Injection (CVE-2026-60137) to compromise the database and achieve Remote Code Execution (RCE)
[Mitigation] Immediately upgrade WordPress core to patched versions (6.9.5, 7.0.2, or later), or temporarily disable the REST API batch endpoint and apply WAF rules
Git Submodule Path CRLF Parsing Flaw and Symlink-Based Remote Code Execution (CVE-2025-48384)
[Affected Scope] All Git versions prior to v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1
[Impact] A remote attacker can craft a malicious repository with specially designed submodule paths and symlinks, leading to arbitrary post-checkout hook execution and full system compromise upon cloning.
[Mitigation] Immediately upgrade Git clients to the patched versions (e.g., v2.50.1) and avoid recursively cloning untrusted repositories.