Netcrook
#unauthenticated RCE
When a Public Sharing Feature Turns Into a Code-Execution Trap
A Langflow vulnerability tracked as CVE-2026-33017 shows how a convenience endpoint can collapse the boundary between shared content and executable Python.
Inside the UniFi OS Chain That Could Turn a Login Barrier into Root Control
A reported pre-authentication chain in UniFi OS shows how already patched bugs can still combine into a high-risk control-plane compromise.
One Form Field, Full Site Control: The WordPress Plugin Bug Attackers Are Chasing
A critical flaw in Everest Forms Pro has turned a routine calculation feature into an unauthenticated route to server-side code execution, with active exploitation now in play.
A Cache Booster, a Serialization Trap, and a Magento Code-Execution Risk
A flaw in Mirasvit’s Full Page Cache Warmer extension shows how a performance add-on can become a security-sensitive entry point when untrusted PHP objects reach deserialization code.
ChromaDB’s Hidden Fault Line: How a Single Request Could Turn into Server Control
A newly flagged ChromaDB weakness underscores a hard truth in AI infrastructure: if request handling and trust checks are ordered badly, an ordinary API call can become a code-execution event.
One Rewrite Rule, One Heap Overflow: NGINX’s Hidden RCE Risk
A long-lived flaw in NGINX’s rewrite path shows how ordinary routing syntax can become a memory-corruption problem when the right configuration pattern is present.
Inside the NGINX Rewrite Trap: A Long-Buried Bug Turns Public
A public proof-of-concept has put a memory-corruption flaw in NGINX’s rewrite engine under a harsh spotlight, with impact shaped by configuration and memory-protection settings.