Known exploited vulnerabilities
rConfig vulnerabilities attackers have used
Every rConfig vulnerability in CISA's Known Exploited Vulnerabilities catalog, newest first, with the federal due date and whether it fed ransomware campaigns.
The short answer
CISA lists 1 rConfig vulnerability as exploited in the wild, 0 of them added in the last 12 months. The most recent is CVE-2020-10221, added Nov 3, 2021. rConfig has the most entries (1).
- In KEV, all time
- 1
- Added, last 12 months
- 0
- Used in ransomware
- 0
- New CVEs this week
- 1
New Critical and High rConfig CVEs this week
- CVE-2026-124079criticalrConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 contain a deserialization of untrusted data vulnerability that allows unauthenticated network attackers to execute arbitrary code by pushing a crafted serialized job onto the Redis-backed Laravel Horizon queue, which runs without authentication in affected…
Every rConfig entry in CISA KEV
CVE-2020-10221
Added · duerConfig OS Command Injection Vulnerability
rConfig lib/ajaxHandlers/ajaxAddTemplate.php contains an OS command injection vulnerability that allows remote attackers to execute OS commands via shell metacharacters in the fileName POST parameter.
Related
Know the day a CVE lands in your code
Connect a GitHub repository and ZeusQA checks its dependencies daily, briefs each advisory and opens the fix. Three test runs free, no card.