Critical FortiSIEM Flaw with Public Exploit Enables Remote Code Execution
A critical unauthenticated remote code execution vulnerability affecting Fortinet FortiSIEM (CVE-2026-106173) now has a public proof-of-concept exploit available.
Tag
#Remote Code Execution
34 results in the archive.
Hackers Exploit Critical RCE Flaw in Collabora to Backdoor Nextcloud
Threat actors are actively exploiting a critical remote code execution vulnerability in the Collabora Online CODE Server app used by Nextcloud servers, enabling unauthorized system access and backdoors.
Palo Alto Networks alerts on critical PAN-OS RCE zero-day exploited in the wild
Palo Alto Networks has released patches for CVE-2026-0322, a critical remote code execution vulnerability actively exploited in PAN-OS firewalls, posing major risks to enterprise networks.
Critical Bricksforge WordPress Flaw Enables Unauthenticated RCE Exploited
A critical unauthenticated remote code execution vulnerability in the Bricksforge WordPress plugin is actively exploited, affecting vulnerable WordPress sites.
Critical LMCache Flaw Allows Unauthenticated Remote Code Execution
An unpatched critical vulnerability in LMCache's multiprocess mode permits unauthenticated remote code execution on LLM cache servers, creating a high-risk security gap.
Critical Buffer Overflow Found in Savannah lwIP SMTP Client v2.2.1
A critical buffer overflow vulnerability in Savannah lwIP SMTP client v2.2.1 allows remote code execution and device crashes, impacting critical infrastructure devices.
Critical Vulnerabilities Discovered in Eufy Omni C20 and Omni X10 Pro
Multiple high-severity vulnerabilities in Eufy Omni C20 and Omni X10 Pro cameras could allow attackers to execute system commands, abuse hard-coded credentials, or conduct man-in-the-middle attacks.
Check Point Warns of Active Exploitation in Security Gateway VPN RCE Flaw
Check Point confirmed active exploitation of a pre-authentication remote code execution vulnerability (CVE-2026-85102) affecting the VPN certificate handling of its Security Gateway product, enabling remote attackers to execute code without authentication.
WordPress Patches Critical Flaw Allowing Remote Code Execution
WordPress released a patch for a critical vulnerability that allowed unauthenticated attackers to load PHP files externally, risking remote code execution on affected servers.
Critical Pre-Auth RCE Found and Exploited in Orkes Conductor Platform
A critical unauthenticated remote code execution vulnerability (CVE-2026-58138) in Orkes Conductor affecting versions prior to 3.30.2 is actively exploited and presents severe security risks.
Critical RCE Flaw in Unbound DNSSEC Validator Fixed in 1.26.1
A critical heap overflow vulnerability in Unbound DNSSEC validator before version 1.26.1 allows remote code execution via malicious DNS zones.
Red Heron Exploits Gitea RCE to Compromise 13 Organizations Globally
The state-sponsored threat actor Red Heron exploited a remote code execution vulnerability in Gitea to compromise 13 organizations across six countries in a rapid, targeted campaign.
N-able patches critical RCE flaw in N-central amid active exploitation
N-able has released an emergency hotfix for a critical remote code execution vulnerability in its N-central RMM platform that is actively exploited.
Critical Cisco Nexus 9000 Flaw Lets Remote Attackers Run Code as Root
Cisco released a patch for a critical vulnerability in Silicon One-based Nexus 9000 switches that allows unauthenticated remote code execution as root, identified as CVE-2026-20212 with a 9.8 CVSS score.
Critical Langflow Flaw Exploited to Steal OpenAI and AWS Keys
An unauthenticated remote code execution vulnerability in Langflow is exploited to steal sensitive OpenAI and AWS credentials, posing substantial risks to cloud and AI security.
Critical Avada WordPress Theme Flaw Enables Zero-Click Remote Code Execution
A critical zero-click remote code execution vulnerability in the Avada WordPress theme allows unauthenticated attackers to execute arbitrary PHP code on affected servers.
Hackers Breached 270+ Zimbra Servers via Critical RCE Vulnerability
Over 270 Zimbra Collaboration Suite servers have been breached through exploitation of a critical remote code execution vulnerability, exposing organizations to significant security risks.
Critical RCE Flaw in Windows IKE Extension Actively Exploited
CISA warns of active exploitation of a critical remote code execution vulnerability in the Windows Internet Key Exchange Service Extensions, enabling attacker code execution without user interaction.
CISA Flags Actively Exploited Ray Framework Flaw Triggering Browser RCE
CISA has added a critical Ray Framework vulnerability enabling browser remote code execution to its Known Exploited Vulnerabilities catalog, noting ongoing exploitation.
Critical SAP Commerce Cloud RCE Flaw Targeted in Active Attacks
A maximum-severity remote code execution vulnerability in SAP Commerce Cloud patched just three days ago is now actively exploited, posing a critical security risk.
Critical RCE Vulnerability Found in Siemens Siveillance Video
Siemens patched a critical remote code execution vulnerability in multiple versions of its Siveillance Video Management Servers that threatens critical infrastructure.
Critical VMware vCenter Vulnerability Actively Exploited for Remote Access
Threat actors are exploiting the critical directory traversal vulnerability CVE-2026-59310 in VMware vCenter, enabling remote code execution and requiring immediate attention from defenders.
AI-Assisted Exploit Enables Unauthenticated RCE on SharePoint Servers
A critical SharePoint vulnerability (CVE-2026-55040) enables unauthenticated remote code execution, facilitated by AI, affecting several SharePoint Server versions.
Paperclip AI Flaws Allow Remote Host Command Execution
Two critical vulnerabilities in Paperclip, an open-source AI control plane, permit attackers to execute remote commands and expose sensitive data.
Adobe Campaign Classic CVSS 10.0 Flaw Enables Code Execution Without User Action
Adobe Campaign Classic includes a critical CVSS 10.0 vulnerability (CVE-2026-48449) that allows arbitrary code execution without user interaction.
JetBrains warns of critical TeamCity remote code execution flaw
JetBrains disclosed a critical authentication bypass vulnerability in TeamCity On-Premises that enables remote code execution, posing significant risk to enterprise environments.
Critical Ruflo MCP Flaw Enables Remote Code Execution and AI Memory Poisoning
A critical vulnerability in the Ruflo open-source agent platform allows unauthenticated remote code execution and poisoning of AI memory, posing significant risks to AI model operations.
Fastjson 1.x RCE Vulnerability Actively Targeted, No Patch Available
Attackers are exploiting a critical remote code execution vulnerability in Fastjson 1.x used in Spring Boot applications, enabling unauthenticated code execution with Java process privileges and no patch currently available.
Critical Bing Image Flaw Allows SVGs to Execute Commands as SYSTEM
A crafted SVG submitted to Bing image search can execute commands as NT AUTHORITY\SYSTEM on Microsoft’s production servers, impacting multiple hosts with critical security implications.
CISA urgent patch order for exploited Langflow RCE vulnerability
CISA has mandated U.S. federal agencies to urgently address a remote code execution vulnerability actively exploited in Langflow, posing critical risks to infrastructure security.
Critical SharePoint RCE CVE-2026-50522 Actively Exploited
Microsoft patched a critical SharePoint Server vulnerability, CVE-2026-50522, now actively exploited after a public proof-of-concept was released, enabling remote code execution via deserialization of untrusted data.
WordPress Core SQL Injection Vulnerability CVE-2026-63030 Exploited
A critical SQL injection vulnerability identified as CVE-2026-63030 affects WordPress Core and is actively exploited, allowing unauthenticated remote code execution.
Critical NGINX Vulnerability Risks Worker Crashes and Remote Code Execution
F5 released patches for CVE-2026-42533, a critical nginx flaw allowing remote, unauthenticated attackers to trigger a heap buffer overflow that can crash workers or enable remote code execution.
CISA warns of active RCE flaws in Joomla iCagenda and Balbooa Forms extensions
CISA warns that remote code execution vulnerabilities are actively exploited in Joomla iCagenda and Balbooa Forms extensions through arbitrary file uploads, risking full compromise of affected sites.