CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Critical RCE in Nextcloud Collabora Online Built-in CODE Server (CVE-2026-110447)
[Affected Scope] Collabora Online Built-in CODE Server (richdocumentscode) for Nextcloud before version 26.4.303.
[Impact] Unauthenticated remote attackers can execute arbitrary OS commands, leading to full system compromise.
[Mitigation] Update the richdocumentscode app to version 26.4.303 or later immediately.
WordPress Core get_page_template() Local File Inclusion (LFI) and Remote Code Execution (RCE) (CVE-2026-87902)
[Affected Scope] All WordPress installations running vulnerable core versions and specific themes.
[Impact] Unauthenticated attackers can include and execute arbitrary local PHP files, leading to full server compromise.
[Mitigation] Immediate update to the latest WordPress security release and deployment of WAF filtering rules.
Adobe Commerce (Magento) Server-Side Template Injection (SSTI) Remote Code Execution (CVE-2026-75650)
[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.
[Impact] Unauthenticated attackers can execute arbitrary code with server privileges, leading to full system compromise and sensitive data theft.
[Mitigation] Immediately apply Adobe security patches (APSB26-146) and implement WAF rules to block malicious template patterns.
Apache Struts 2 Dynamic Method Invocation (DMI) Remote Code Execution (CVE-2016-3081, S2-032)
[Affected Scope] Apache Struts versions 2.3.19 through 2.3.28 with Dynamic Method Invocation (DMI) enabled.
[Impact] Remote attackers can execute arbitrary code (RCE) with server privileges via specially crafted HTTP requests, leading to full system compromise.
[Mitigation] Immediately upgrade to Struts 2.3.20.3, 2.3.24.3, or 2.3.28.1 and set 'struts.enable.DynamicMethodInvocation' to 'false'.