#Unauthenticated RCE
All CosmicBytez Labs articles tagged #Unauthenticated RCE, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-94952: Critical Unauthenticated Stack Overflow in TOTOLINK N150RT Routers
CVSS 9.8 unauthenticated stack overflow in TOTOLINK N150RT's formPortFw handler risks remote crash or code execution; no patch exists for this EOL router.
- News
Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication
A CVSS 10.0 zero-day in Metabase is actively exploited, granting unauthenticated attackers full admin access to the popular BI platform. No CVE identifier yet.
- Security
CVE-2026-27053: Critical PHP Object Injection in Broadcast Live Video Plugin
A critical unauthenticated PHP Object Injection vulnerability in the Broadcast Live Video WordPress plugin (versions < 7.1.3) carries a CVSS score of 9.8...
- Security
CVE-2026-8935: WP Maps Pro Unauthenticated Admin Account Creation (CVSS 9.8)
A critical unauthenticated vulnerability in the WP Maps Pro WordPress plugin before 6.1.1 allows any visitor to create an administrator account and...
- Security
CVE-2026-34311 — Oracle Hospitality OPERA 5 Unauthenticated RCE
A CVSS 9.8 critical vulnerability in Oracle Hospitality OPERA 5 Property Services allows unauthenticated network attackers to fully compromise hotel...
- Security
CVE-2026-8153: Universal Robots PolyScope OS Command
A critical OS command injection flaw in Universal Robots PolyScope Dashboard Server (CVSS 9.8) allows unauthenticated attackers to execute arbitrary...
- Security
CVE-2026-3844 — Breeze Cache WordPress Plugin
A critical unauthenticated file upload vulnerability in the Breeze Cache WordPress plugin allows attackers to upload arbitrary files to affected servers...
- Security
CVE-2026-37749: SQL Injection Auth Bypass in CodeAstro
A critical SQL injection vulnerability in CodeAstro Simple Attendance Management System v1.0 allows unauthenticated remote attackers to bypass login...
- Security
CVE-2026-1579: MAVLink Protocol Unauthenticated Shell Access
A critical CVSS 9.8 vulnerability in the MAVLink drone communication protocol allows unauthenticated attackers to send arbitrary SERIAL_CONTROL commands —...