Silent Lynx Exploitat WinRAR Vitium ad Instruendum Reverse Shell in Attacis Regni CIS · 4h NGINX Corrigit 5 Vitia, Inclusa Possibili RCE et Bug TLS Qui Potest Saltare Client-Cert Checks · 7h Next.js Emittit Emendationem Extra Ordinem pro Duobus Criticis RCE Defectibus in Caching et SVG Processu · 7h Drupal Patches Criticum Core RCE Vitium Sine Login Via Contributis Modulis · 8h Vulnerabilitas in software Sparx Systems Enterprise Architect · 8h Curl verhelpt 'high' RCE-kwetsbaarheid gevonden door Anthropic · 8h Vulnerabilitates in Slican telephonis · 9h Palo Alto Networks monet ad abusum vulnerabilitatis in ignibus securitatis · 12h Cisco nuntiat activum abusus criticae vulnerabilitatis in Secure Email Gateway · 13h Langflow's Critica Authenticated RCE Vulnerabilitas Targetata in 1,423 Honeypot Exploit Conatibus · 13h Silent Lynx Exploitat WinRAR Vitium ad Instruendum Reverse Shell in Attacis Regni CIS · 4h NGINX Corrigit 5 Vitia, Inclusa Possibili RCE et Bug TLS Qui Potest Saltare Client-Cert Checks · 7h Next.js Emittit Emendationem Extra Ordinem pro Duobus Criticis RCE Defectibus in Caching et SVG Processu · 7h Drupal Patches Criticum Core RCE Vitium Sine Login Via Contributis Modulis · 8h Vulnerabilitas in software Sparx Systems Enterprise Architect · 8h Curl verhelpt 'high' RCE-kwetsbaarheid gevonden door Anthropic · 8h Vulnerabilitates in Slican telephonis · 9h Palo Alto Networks monet ad abusum vulnerabilitatis in ignibus securitatis · 12h Cisco nuntiat activum abusus criticae vulnerabilitatis in Secure Email Gateway · 13h Langflow's Critica Authenticated RCE Vulnerabilitas Targetata in 1,423 Honeypot Exploit Conatibus · 13h

ACyber Sentinel Turma Aestimationis Securitatis

← Redire

⚠️ Renuntiatio Vulnerabilitatis

CVE-2026-58138

CRITICAL CVSS 9.8 CVSS 3.1 📌 Deferred

CVE-2026-58138 - Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators

Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to authentication. Attackers can exploit unsandboxed GraalVM evaluators configured with HostAccess.ALL or allowAllAccess(true) through INLINE, LAMBDA, DO_WHILE, and SWITCH task types to invoke arbitrary system commands via Java reflection or direct subprocess calls.

Publicatum: Jun 30, 2026 19:17

Ultima Mutatio: Jul 14, 2026 22:17