Tag
39 results in the archive.
Hackers are actively exploiting the Plex2Shell vulnerability chain to breach QNAP NAS devices, prompting QNAP to urge users to update Plex Media Server via the QNAP App Center to reduce risk.
More than 1,000 Internet-exposed GitLab servers remain unpatched against a critical remote code execution vulnerability actively exploited by attackers.
Hewlett Packard Enterprise released fixes for 72 vulnerabilities in ArubaOS, including eight critical remote code execution and authentication bypass flaws.
A critical unauthenticated remote code execution vulnerability affecting GitLab self-managed servers since version 7.0 in 2014 was patched on October 21, 2026.
CISA alerts on critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 enabling unauthenticated remote code execution, affecting all PHP-based web servers.
A critical unauthenticated remote code execution vulnerability affecting Fortinet FortiSIEM (CVE-2026-106173) now has a public proof-of-concept exploit available.
Threat actors are actively exploiting a critical remote code execution vulnerability in the Collabora Online CODE Server app used by Nextcloud servers, enabling unauthorized system access and backdoors.
Palo Alto Networks has released patches for CVE-2026-0322, a critical remote code execution vulnerability actively exploited in PAN-OS firewalls, posing major risks to enterprise networks.
A critical unauthenticated remote code execution vulnerability in the Bricksforge WordPress plugin is actively exploited, affecting vulnerable WordPress sites.
An unpatched critical vulnerability in LMCache's multiprocess mode permits unauthenticated remote code execution on LLM cache servers, creating a high-risk security gap.
A critical buffer overflow vulnerability in Savannah lwIP SMTP client v2.2.1 allows remote code execution and device crashes, impacting critical infrastructure devices.
Multiple high-severity vulnerabilities in Eufy Omni C20 and Omni X10 Pro cameras could allow attackers to execute system commands, abuse hard-coded credentials, or conduct man-in-the-middle attacks.
Check Point confirmed active exploitation of a pre-authentication remote code execution vulnerability (CVE-2026-85102) affecting the VPN certificate handling of its Security Gateway product, enabling remote attackers to execute code without authentication.
WordPress released a patch for a critical vulnerability that allowed unauthenticated attackers to load PHP files externally, risking remote code execution on affected servers.
A critical unauthenticated remote code execution vulnerability (CVE-2026-58138) in Orkes Conductor affecting versions prior to 3.30.2 is actively exploited and presents severe security risks.
A critical heap overflow vulnerability in Unbound DNSSEC validator before version 1.26.1 allows remote code execution via malicious DNS zones.
The state-sponsored threat actor Red Heron exploited a remote code execution vulnerability in Gitea to compromise 13 organizations across six countries in a rapid, targeted campaign.
N-able has released an emergency hotfix for a critical remote code execution vulnerability in its N-central RMM platform that is actively exploited.
Cisco released a patch for a critical vulnerability in Silicon One-based Nexus 9000 switches that allows unauthenticated remote code execution as root, identified as CVE-2026-20212 with a 9.8 CVSS score.
An unauthenticated remote code execution vulnerability in Langflow is exploited to steal sensitive OpenAI and AWS credentials, posing substantial risks to cloud and AI security.
A critical zero-click remote code execution vulnerability in the Avada WordPress theme allows unauthenticated attackers to execute arbitrary PHP code on affected servers.
Over 270 Zimbra Collaboration Suite servers have been breached through exploitation of a critical remote code execution vulnerability, exposing organizations to significant security risks.
CISA warns of active exploitation of a critical remote code execution vulnerability in the Windows Internet Key Exchange Service Extensions, enabling attacker code execution without user interaction.
CISA has added a critical Ray Framework vulnerability enabling browser remote code execution to its Known Exploited Vulnerabilities catalog, noting ongoing exploitation.
A maximum-severity remote code execution vulnerability in SAP Commerce Cloud patched just three days ago is now actively exploited, posing a critical security risk.
Siemens patched a critical remote code execution vulnerability in multiple versions of its Siveillance Video Management Servers that threatens critical infrastructure.
Threat actors are exploiting the critical directory traversal vulnerability CVE-2026-59310 in VMware vCenter, enabling remote code execution and requiring immediate attention from defenders.
A critical SharePoint vulnerability (CVE-2026-55040) enables unauthenticated remote code execution, facilitated by AI, affecting several SharePoint Server versions.
Two critical vulnerabilities in Paperclip, an open-source AI control plane, permit attackers to execute remote commands and expose sensitive data.
Adobe Campaign Classic includes a critical CVSS 10.0 vulnerability (CVE-2026-48449) that allows arbitrary code execution without user interaction.
JetBrains disclosed a critical authentication bypass vulnerability in TeamCity On-Premises that enables remote code execution, posing significant risk to enterprise environments.
A critical vulnerability in the Ruflo open-source agent platform allows unauthenticated remote code execution and poisoning of AI memory, posing significant risks to AI model operations.
Attackers are exploiting a critical remote code execution vulnerability in Fastjson 1.x used in Spring Boot applications, enabling unauthenticated code execution with Java process privileges and no patch currently available.
A crafted SVG submitted to Bing image search can execute commands as NT AUTHORITY\SYSTEM on Microsoft’s production servers, impacting multiple hosts with critical security implications.
CISA has mandated U.S. federal agencies to urgently address a remote code execution vulnerability actively exploited in Langflow, posing critical risks to infrastructure security.
Microsoft patched a critical SharePoint Server vulnerability, CVE-2026-50522, now actively exploited after a public proof-of-concept was released, enabling remote code execution via deserialization of untrusted data.
A critical SQL injection vulnerability identified as CVE-2026-63030 affects WordPress Core and is actively exploited, allowing unauthenticated remote code execution.
F5 released patches for CVE-2026-42533, a critical nginx flaw allowing remote, unauthenticated attackers to trigger a heap buffer overflow that can crash workers or enable remote code execution.
CISA warns that remote code execution vulnerabilities are actively exploited in Joomla iCagenda and Balbooa Forms extensions through arbitrary file uploads, risking full compromise of affected sites.