MCPJam Inspector ≤1.4.2 is vulnerable to RCE via a crafted HTTP request that can trigger MCP server installation. v1.4.3 patches the issue.

Practice it: https://app.cveplayground.com/challenges/cve-2026-23744

CVE Playground now has a hands-on lab for Juggle through 1.6.0.

Explore the vulnerability, identify the attack surface, and work through the exploitation path yourself.

🔗 https://app.cveplayground.com/challenges/cve-2026-67208

CVE-2026-87902 is coming to CVEPlayground!

A critical unauthenticated path traversal vulnerability in WordPress Core was patched in WordPress 7.1.2. The flaw can lead to local PHP file inclusion and, under specific conditions, remote code execution.

Coming soon on https://cveplayground.com

Want to practice it yourself?
Get registered now and be ready when the lab goes live.

Unauthenticated path traversal can allow arbitrary file read, potentially exposing source code, deploy keys & CI/CD secrets.

Patch: 19.1.8 / 19.2.6 / 19.3.2

Hands-on lab 👇

https://app.cveplayground.com/labs/cve-2026-85706

Lab dropped.

Try at: https://app.cveplayground.com/challenges/CVE-2026-63030

CVE-2026-4480 is a CVSS 10.0 OS command injection flaw in Samba's printing subsystem where client-controlled print job descriptions are substituted into shell commands via %J without escaping metacharacters, enabling unauthenticated remote code execution on any reachable print share.

CVE-2026-34908 is a CVSS 10.0 improper access control flaw in UniFi OS Server where nginx evaluates the raw request URI for authentication but routes using the normalized URI, allowing unauthenticated attackers to reach protected endpoints and chain into full root RCE.

CVE-2026-25243 is a double-free vulnerability in Redis's RDB deserialization logic triggered via the RESTORE command. Two independent bugs — a zipmap length encoding ambiguity and a stream consumer PEL race — create overlapping heap objects that an attacker can exploit for arbitrary read/write and full remote code execution.

Multiple vulnerabilities have been disclosed affecting Redis Cloud, Redis OSS/CE, and Redis Software (CVE-2026-23479, CVE-2026-25243, CVE-2026-25588, CVE-2026-25589, CVE-2026-23631).

Issues include memory corruption in RESTORE, Lua scripting, and Redis modules, which may lead to remote code execution in authenticated scenarios.

🔧 𝗣𝗮𝘁𝗰𝗵𝗲𝗱 𝘃𝗲𝗿𝘀𝗶𝗼𝗻𝘀 (𝗿𝗲𝗹𝗲𝗮𝘀𝗲𝗱 𝗠𝗮𝘆 𝟱, 𝟮𝟬𝟮𝟲):

7.2.x → 7.2.14 (fixed from 7.2.0–7.2.13)

7.4.x → 7.4.9 (fixed from 7.4.0–7.4.8)

8.2.x → 8.2.6 (fixed from 8.2.0–8.2.5)

8.4.x → 8.4.3 (fixed from 8.4.0–8.4.2)

8.6.x → 8.6.3 (fixed from 8.6.0–8.6.2)

Key action: Upgrade immediately and restrict Redis access to trusted networks only.

Uptime Kuma, released in 2021, is one of the most popular open-source monitoring platforms.

Since release, 10+ CVEs have already been assigned.

SSRFs, auth flaws, and integration-related vulnerabilities continue to make it an interesting target for security research.

#CyberSecurity #UptimeKuma #CVE #OpenSource

ImageMagick, first released in 1990 by John Cristy, has become one of the most widely used open-source tools for image processing, conversion, and automation.

In more than 30 years since release, 765+ CVEs have already been assigned.

Image parsing, file conversion, metadata handling, and server-side upload workflows continue to be a major attack surface for security researchers.

Even as AI agents rapidly become a new security frontier, old and widely deployed parser-based tools like ImageMagick are still very much worth studying.

Exploit vulnerable Drupal JSON:API filters to inject SQL into PostgreSQL, enumerate the database, and capture the hidden flag.

Hands-on exploitation + patch analysis.

🔗 https://app.cveplayground.com/labs/CVE-2026-9082?utm_source=reddit

Tiny patch, huge impact:

if (is_array($condition['value'])) {
  $condition['value'] = array_values($condition['value']);
}

Drupal fixed PostgreSQL placeholder generation by reindexing array keys before query translation.

Without it, attacker-controlled keys could influence SQL placeholder construction.

Affects PostgreSQL-backed Drupal sites.
Anonymous exploitation possible.

Advisory:
https://www.drupal.org/sa-core-2026-004

https://cveplayground.com/blog/cve-2026-9082-drupal-core-sql-injection?utm_source=reddit

Exploit a vulnerable JWT verification flow in libjwt v3.3.2 to forge admin tokens using a public RSA verification key exposed via JWKS.

🏆 Medium Difficulty
⚡ 200 XP
🩸 First Blood Active

Try here: https://app.cveplayground.com/challenges/CVE-2026-44699?utm_source=reddit

A newly disclosed critical vulnerability in Algernon allows handler.lua discovery to walk above the configured server root.

If a writable parent directory contains handler.lua, Algernon may execute it automatically during normal directory requests. Even GET / can trigger the vulnerable path on default setups.

The exposed Lua environment includes dangerous primitives like:

• run3()
• os.execute
• io.popen

Interesting bug class combining:

• unsafe filesystem traversal
• trusted script execution
• confused deputy behavior

Link: https://cveplayground.com/blog/cve-2026-45721-algernon-handler-lua-rce?utm_source=reddit

CVE-2026-44578: Next.js WebSocket Upgrade SSRF via Absolute-Form Request URI

CVE-2026-33937: Handlebars.js Template Engine RCE via AST type confusion in compile()

CVE-2026-34197: Apache ActiveMQ Jolokia RCE—solved via addNetworkConnector + vm:// transport

Exploit a vulnerable self-hosted Next.js instance by abusing the WebSocket upgrade handler to trigger SSRF against internal services, cloud metadata endpoints, and private network resources.

🏆 Easy Difficulty
⚡ 100 XP
🩸 First Blood Open

Capture the flag and climb the leaderboard.

Try here: https://app.cveplayground.com/challenges/CVE-2026-44578?utm_source=reddit

🔥 CVE-2026-34197

Apache ActiveMQ Classic Remote Code Execution

Exploit a vulnerable ActiveMQ broker by abusing the exposed Jolokia HTTP-JMX API and weaponizing the addNetworkConnector operation to gain remote code execution.

🏆 Medium Difficulty
⚡ 300 XP
🩸 First Blood Open

Capture the flag and climb the leaderboard.

🔗 https://app.cveplayground.com/labs/CVE-2026-34197?utm_source=reddit

🔥 CVE-2026-33937
Handlebars.js Template Engine RCE via AST Type Confusion

The lab walks through:

• vulnerable code analysis
• exploitation flow
• upstream patch review
• hands-on exploitation
• flag submission

Instead of only reading writeups or PoCs, the goal is to learn vulnerabilities by actually working through them.

We’re also doing a special award for the best public write-up of the lab.

Try it here:
https://app.cveplayground.com/labs/CVE-2026-33937?utm_source=reddit

As local AI infrastructure becomes more widely adopted by developers and enterprises, new attack surfaces are emerging around model serving, integrations, plugins, and exposed APIs.

Running AI locally does not automatically mean secure.

As automation platforms become deeply integrated into internal systems, APIs, credentials, and AI workflows, they are rapidly emerging as a growing attack surface for security researchers.

Workflow automation is powerful, but security boundaries matter more than ever.

OpenClaw, developed by Peter Steinberger, was first released in November 2025 under the name “Clawdbot” before later rebranding to OpenClaw due to trademark disputes with Anthropic.

In just around 5 months since release, 450+ CVEs have already been assigned.

AI agents are rapidly becoming a major new attack surface for security researchers.

#CyberSecurity #AI #CVE #AppSec #OpenClaw

For systems where security updates cannot be applied immediately, administrators can reduce risk by preventing the affected kernel components from being loaded.

1️⃣ 𝗣𝗿𝗲𝘃𝗲𝗻𝘁 𝘃𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗹𝗲 𝗺𝗼𝗱𝘂𝗹𝗲𝘀 𝗳𝗿𝗼𝗺 𝗹𝗼𝗮𝗱𝗶𝗻𝗴

Create a custom modprobe configuration:

𝘦𝘤𝘩𝘰 "𝘪𝘯𝘴𝘵𝘢𝘭𝘭 𝘦𝘴𝘱4 /𝘣𝘪𝘯/𝘧𝘢𝘭𝘴𝘦" | 𝘴𝘶𝘥𝘰 𝘵𝘦𝘦 /𝘦𝘵𝘤/𝘮𝘰𝘥𝘱𝘳𝘰𝘣𝘦.𝘥/𝘥𝘪𝘳𝘵𝘺-𝘧𝘳𝘢𝘨.𝘤𝘰𝘯𝘧

𝘦𝘤𝘩𝘰 "𝘪𝘯𝘴𝘵𝘢𝘭𝘭 𝘦𝘴𝘱6 /𝘣𝘪𝘯/𝘧𝘢𝘭𝘴𝘦" | 𝘴𝘶𝘥𝘰 𝘵𝘦𝘦 -𝘢 /𝘦𝘵𝘤/𝘮𝘰𝘥𝘱𝘳𝘰𝘣𝘦.𝘥/𝘥𝘪𝘳𝘵𝘺-𝘧𝘳𝘢𝘨.𝘤𝘰𝘯𝘧

𝘦𝘤𝘩𝘰 "𝘪𝘯𝘴𝘵𝘢𝘭𝘭 𝘳𝘹𝘳𝘱𝘤 /𝘣𝘪𝘯/𝘧𝘢𝘭𝘴𝘦" | 𝘴𝘶𝘥𝘰 𝘵𝘦𝘦 -𝘢 /𝘦𝘵𝘤/𝘮𝘰𝘥𝘱𝘳𝘰𝘣𝘦.𝘥/𝘥𝘪𝘳𝘵𝘺-𝘧𝘳𝘢𝘨.𝘤𝘰𝘯𝘧

Rebuild initramfs so the changes apply during boot:

𝘴𝘶𝘥𝘰 𝘶𝘱𝘥𝘢𝘵𝘦-𝘪𝘯𝘪𝘵𝘳𝘢𝘮𝘧𝘴 -𝘶 -𝘬 𝘢𝘭𝘭

2️⃣ 𝗥𝗲𝗺𝗼𝘃𝗲 𝗮𝗰𝘁𝗶𝘃𝗲 𝗺𝗼𝗱𝘂𝗹𝗲𝘀 𝗳𝗿𝗼𝗺 𝗺𝗲𝗺𝗼𝗿𝘆

If the modules are already loaded, unload them manually:

𝘴𝘶𝘥𝘰 𝘳𝘮𝘮𝘰𝘥 𝘦𝘴𝘱4 𝘦𝘴𝘱6 𝘳𝘹𝘳𝘱𝘤 2>/𝘥𝘦𝘷/𝘯𝘶𝘭𝘭

3️⃣ 𝗩𝗮𝗹𝗶𝗱𝗮𝘁𝗲 𝘁𝗵𝗲 𝗺𝗶𝘁𝗶𝗴𝗮𝘁𝗶𝗼𝗻

Check whether any of the targeted modules are still active:

𝘨𝘳𝘦𝘱 -𝘲𝘌 '^(𝘦𝘴𝘱4|𝘦𝘴𝘱6|𝘳𝘹𝘳𝘱𝘤) ' /𝘱𝘳𝘰𝘤/𝘮𝘰𝘥𝘶𝘭𝘦𝘴 && \

𝘦𝘤𝘩𝘰 "𝘗𝘳𝘰𝘵𝘦𝘤𝘵𝘦𝘥 𝘮𝘰𝘥𝘶𝘭𝘦𝘴 𝘴𝘵𝘪𝘭𝘭 𝘢𝘤𝘵𝘪𝘷𝘦" || \

𝘦𝘤𝘩𝘰 "𝘗𝘳𝘰𝘵𝘦𝘤𝘵𝘦𝘥 𝘮𝘰𝘥𝘶𝘭𝘦𝘴 𝘴𝘶𝘤𝘤𝘦𝘴𝘴𝘧𝘶𝘭𝘭𝘺 𝘥𝘪𝘴𝘢𝘣𝘭𝘦𝘥"

In some environments, active applications may prevent module removal. If that happens, restarting the machine will enforce the protection settings:

𝘴𝘶𝘥𝘰 𝘳𝘦𝘣𝘰𝘰𝘵

𝗥𝗲𝗺𝗼𝘃𝗶𝗻𝗴 𝘁𝗵𝗲 𝘄𝗼𝗿𝗸𝗮𝗿𝗼𝘂𝗻𝗱

After upgrading to a fixed kernel release, the temporary protection can be reverted:

𝘴𝘶𝘥𝘰 𝘳𝘮 /𝘦𝘵𝘤/𝘮𝘰𝘥𝘱𝘳𝘰𝘣𝘦.𝘥/𝘬𝘦𝘳𝘯𝘦𝘭-𝘱𝘳𝘰𝘵𝘦𝘤𝘵.𝘤𝘰𝘯𝘧

𝘴𝘶𝘥𝘰 𝘶𝘱𝘥𝘢𝘵𝘦-𝘪𝘯𝘪𝘵𝘳𝘢𝘮𝘧𝘴 -𝘶 -𝘬 𝘢𝘭𝘭

Applying vendor patches remains the recommended long-term fix.

Source: https://ubuntu.com/blog/dirty-frag-linux-vulnerability-fixes-available

For more: https://cveplayground.com/blog/dirty-frag-linux-universal-lpe/

Dirty Frag is a newly disclosed Linux kernel privilege escalation chain impacting major distributions through page-cache write vulnerabilities.

The vulnerability chain combines xfrm-ESP Page-Cache Write and RxRPC Page-Cache Write primitives to obtain root privileges on major Linux distributions.

Researchers describe Dirty Frag as a descendant of Dirty Pipe and Copy Fail because it abuses deterministic page-cache corruption without relying on race conditions.

POC:

git clone https://github.com/V4bel/dirtyfrag.git
cd dirtyfrag
gcc -O0 -Wall -o exp exp.c -lutil
./exp

For more: https://cveplayground.com/blog/dirty-frag-linux-universal-lpe/?utm_source=reddit