CVE WatchJul 8, 2026

CVE-2025-53827

ownCloud Core is the server-side component of the file storage, synchronization, and sharing application ownCloud Classic. In versions prior

CVSS

9.1

Critical

EPSS

0.3%

p26

KEV

—

Exploit Today

0-100

Published: Jul 6, 2026 · Last modified: Jul 8, 2026 · CWE-749

EPSS · 30d

0.3%EPSS · 30 days0.3%

2026-07-072026-07-16

Technical description

ownCloud Core is the server-side component of the file storage, synchronization, and sharing application ownCloud Classic. In versions prior to 10.15.3, the Updater on ownCloud 10 before 10.15.3 has an exposed dangerous method or function. Attackers with administrative privileges may leverage functionality to execute arbitrary code. This issue has been fixed in version 10.15.3.

Official references

github.comhttps://github.com/owncloud/security-advisories/security/advisories/GHSA-hvcx-ph66-mmvw

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2025-9611—

63.2%

——19Microsoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections. This allows an attacker to perform a DNS rebinding attack via a victim’s web browser and send unauthorized requests to a locally running MCP server, resulting in unintended invocation of MCP tool endpoints.2d CVE-2026-222089.6 CRI

56.4%

——17OpenS100 (the reference implementation S-100 viewer) prior to commit 753cf29 contains a remote code execution vulnerability via an unrestricted Lua interpreter. The Portrayal Engine initializes Lua using luaL_openlibs() without sandboxing or capability restrictions, exposing standard libraries such as 'os' and 'io' to untrusted portrayal catalogues. An attacker can provide a malicious S-100 portrayal catalogue containing Lua scripts that execute arbitrary commands with the privileges of the OpenS100 process when a user imports the catalogue and loads a chart.3d CVE-2026-241189.8 CRI

56.2%

——17vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This issue has been patched in version 3.11.0.2d CVE-2026-412839.9 CRI

50.2%

——15OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials.2d CVE-2026-536339.8 CRI

44.0%

——13Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp() API that forwarded raw Chrome DevTools Protocol methods without being gated by allowWrite or allowExec, allowing a remote client with exposed browser API metadata to use CDP Page.setDownloadBehavior and Runtime.evaluate to overwrite vite.config.ts and execute attacker-controlled Node.js code. This issue is fixed in versions 3.2.5, 4.1.8, and 5.0.0-beta.1d CVE-2026-454896.5 MED

38.0%

——11Microsoft Edge (Chromium-based) Spoofing Vulnerability4d