CVE-2022-24990: TerraMaster TOS unauthenticated remote command execution via PHP Object Instantiation

WordPress powers a large share of internet-facing sites. The pre-auth login-screen XSS can execute JavaScript in the site origin after victim interaction and, under the documented conditions, be chained into impact on administrator sessions and the server. Upgrade to WordPress 7.0.3 or the corresponding patched maintenance branch, then review login activity, administrator sessions, and unexpected plugins or file changes. The current CVE record assigns CVSS 4.0 8.9 (High) and requires active user interaction; no active-exploitation signal is currently recorded.

pwn.ai's agent-found zero-day: CVE-2025-54322 yields unauthenticated root RCE on Xspeeder SXZOS edge devices, tens of thousands exposed, disclosed after seven months of vendor silence.

Octagon Networks chains file inclusion (CVE-2021-45467) and file write (CVE-2021-45466) to achieve pre-auth root command execution on CWP CentOS Web Panel, used by 200,000+ servers.

A pre-auth RCE in ForgeRock OpenAM via unsafe deserialization in its Jato framework: the jato.pageSession parameter accepted Java objects exploitable with a custom ysoserial chain (CVE-2021-35464).

Hacktron AI discovers a critical pre-authentication RCE in OpenAM through a forgotten deserialization parameter that the original CVE-2021-35464 fix missed.

Hacktron AI's agents found a critical pre-auth RCE in BeyondTrust Remote Support and older Privileged Remote Access versions, assigned CVE-2026-1731 with a CVSS 9.9 score.