#rce
-
Critical Ghostscript flaw lets attackers hijack servers via PDF uploads
A heap buffer overflow in Ghostscript (CVE-2026-39919) opens the door to remote code execution through a specially crafted PDF file. WordPress sites are the primary target.
-
GitLab Patches Max-Severity Code Execution Flaw in CI/CD Regex Compiler
An integer overflow bug let an unauthenticated attacker run arbitrary code on a GitLab server through a specially crafted regular expression. The company urges immediate upgrades.
-
Critical Bricksforge WordPress Flaw Under Active Exploitation
CVE-2026-85097, rated a maximum CVSS 10.0, lets unauthenticated attackers run arbitrary PHP on WordPress sites. Patchstack says exploitation began on October 7, 2026.
-
Citrix Urges Admins to Patch New NetScaler RCE Flaw at Once
A critical flaw in NetScaler ADC and NetScaler Gateway allows remote code execution or a denial-of-service crash. No active attacks have been seen yet, but more than 21,000 appliances remain exposed online.
-
Unpatched LMCache Flaw Hands Remote Code Execution to Anyone on the Network
JFrog has disclosed a critical hole in LMCache, the open-source accelerator for LLM servers: a single network message can run code on the cache server — as root on the project's official images. No fix exists yet.
-
New Dell System Update flaw hands attackers root access
Dell is urging customers to patch its System Update tool as soon as possible: the flaw lets a remote attacker execute code with root privileges on unpatched systems.
-
Attackers Hit Rejetto HFS: Weak RNG Opens the Door to Admin Session Forgery
A critical flaw in Rejetto HTTP File Server is already under attack: a predictable signing key lets intruders forge an administrator cookie and run arbitrary code.
-
TeamViewer urges users to patch severe flaws as soon as possible
The remote access software maker issued a rare advisory, urging all users to update to version 15.82 without delay.
-
Inside the Citrix NetScaler Exploit: From a DTLS Packet to Root-Level Code
Researchers have published technical details of CVE-2026-88772, a critical flaw in Citrix NetScaler ADC and Gateway. The DTLS buffer overflow is already being abused in the wild.
-
CISA orders federal agencies to patch exploited Citrix flaws by Wednesday
The US cybersecurity agency has ordered agencies to shield their systems against attacks abusing two critical NetScaler vulnerabilities that are already being exploited in the wild.
-
LuaRocks Breach: an RCE Found a Year Late, Exploited All Summer
A flaw in LuaRocks.org allowed arbitrary code execution on the server via rockspec uploads. It was exploited from July 9 to August 20, 2026; the team revoked every credential and moved to a new server.
-
Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Attack
Security firm watchTowr warned of two unpatched remote-code-execution flaws in NetScaler ADC and Gateway. Citrix has neither confirmed the issue nor shipped a fix, and some administrators have simply powered their appliances off.
-
Check Point confirms attacks on VPN Security Gateway RCE flaw
The company reports active exploitation of a pre-authentication flaw, CVE-2026-85102, in its VPN certificate handling, alongside a second bug used as a zero-day since July.
-
Critical WordPress RCE flaw: update without delay
A critical WordPress vulnerability can, under certain limited conditions, let an unauthenticated attacker run arbitrary code. Fixes have shipped for the current branch and been backported as far as version 4.7.
-
WordPress Comment2Shell: How a Comment Could Become a Server Takeover
A WordPress core flaw let an anonymous visitor plant a hidden script in a comment that fired when an administrator opened the page. The fix landed on September 17 in version 7.1.1.
-
HEIF Heist: an attack on image decoders threatens entire ecosystems
Researchers at Hacktron have described a class of vulnerabilities in native HEIF, HEIC and AVIF decoders that allow remote code execution and data leakage through image uploads.
-
SolarWinds Patches Hard-Coded Key Flaw in Access Rights Manager
SolarWinds has released security updates fixing a flaw in Access Rights Manager that allowed arbitrary code execution without authentication. The cause was a hard-coded static key.
-
Critical Vulnerability in Orkes Conductor: Unauthenticated RCE Exploited in Real-World Attacks
Fortinet reports active exploitation of the critical flaw CVE-2026-58138 in the Orkes Conductor workflow orchestration platform, which allows arbitrary commands to be executed without authentication.
-
Critical Check Point Vulnerability Opens Root Access to Management Servers
Check Point has released security updates for CVE-2026-91843, a critical vulnerability that allows code execution with root privileges on Security Management Server and Log Server management systems.
-
Critical Cisco Secure Email Gateway Vulnerability Exploited in Attacks
Cisco has warned of active exploitation of CVE-2026-76461, rated 9.8, which allows remote command execution with root privileges through a specially crafted email.
- More