appsec.fyi

Remote Code Execution (RCE) Resources

Post Share

A curated AppSec resource library covering XSS, SQLi, SSRF, IDOR, RCE, XXE, OSINT, and more.

Remote Code Execution (RCE)

Remote Code Execution (RCE) is the ability for an attacker to execute arbitrary commands or code on a target machine or process. RCE vulnerabilities represent the most critical class of security bugs — they give an attacker the same level of control as a system administrator.

RCE can manifest through many different attack vectors. Command injection occurs when user input is passed unsanitized to system shell commands. Deserialization attacks exploit unsafe object reconstruction in languages like Java, PHP, Python, and .NET. Server-Side Template Injection (SSTI) allows code execution through template engines like Jinja2, Twig, or Freemarker. File upload vulnerabilities can lead to RCE when executable files bypass upload filters and are served by the web server.

In modern applications, RCE often appears in less obvious places: expression language injection in Java frameworks, prototype pollution leading to code execution in Node.js, unsafe use of eval() or dynamic code loading, and vulnerabilities in PDF generators, image processors, and other libraries that shell out to system commands.

RCE bugs consistently command the highest payouts in bug bounty programs because the impact is total system compromise. Chaining lower-severity bugs into RCE — such as SSRF to cloud metadata to code execution — is a common and highly rewarded approach.

This page collects RCE techniques, exploitation writeups, and research across all major platforms and languages.

From Wikipedia

Date Added Link Excerpt
2026-05-20 NEW 2026Max-severity vulnerability in ChromaDB allows unauthenticated remote code execution newsA critical vulnerability has been discovered in ChromaDB, a popular vector database. This max-severity bug permits unauthenticated remote code execution, meaning attackers can potentially compromise the system without needing any credentials. The discovery highlights a significant security risk for users of ChromaDB, enabling them to execute arbitrary code on the vulnerable server. No specific bounty payout amount is mentioned in the provided content. → scworld.com
2026-05-20 NEW 2026Critical RCE SQL Injection and Privilege Escalation Vulnerabilities Affecting Ivanti Endpoint Manager Fortinet FortiClient EMS (CVE-2026-21643) SAP VMware and n8n: CVE Analysis Exploitation and Patch Guidance newsThis content highlights critical vulnerabilities impacting Ivanti Endpoint Manager, Fortinet FortiClient EMS (CVE-2026-21643), SAP, VMware, and n8n. The vulnerabilities include Remote Code Execution (RCE), SQL Injection, and Privilege Escalation. The article provides an analysis of these CVEs, details on how they can be exploited, and guidance on patching to mitigate these security risks. No specific bug bounty payout amounts are mentioned. → rescana.com
2026-05-20 NEW 2026New NGINX Vulnerability Allow Remote Attackers to Trigger Malicious Code newsA critical vulnerability has been discovered in NGINX, a popular web server. This flaw, identified as CVE-2023-40547, allows remote attackers to execute arbitrary code on vulnerable servers. The vulnerability arises from improper handling of HTTP requests, potentially leading to denial-of-service conditions or complete system compromise. Users are strongly advised to update their NGINX installations to the latest version to patch this critical security hole. → cybersecuritynews.com
2026-05-20 NEW 2026New NGINX Vulnerability Exposes Servers to Malicious Code Execution newsA new vulnerability in NGINX, a popular web server, has been discovered that allows for malicious code execution. This flaw could potentially compromise servers running NGINX, exposing them to security risks. Further details on the specific nature of the vulnerability and its impact are available via the provided link. No bug bounty payout amount was specified. → gbhackers.com
2026-05-20 NEW 2026CVE-2026-45829: ChromaDB FastAPI ChromaToast RCE Exploit Now newsThis content announces a remote code execution (RCE) exploit for CVE-2026-45829, affecting ChromaDB's FastAPI ChromaToast component. The exploit allows for compromising the system remotely. No specific bounty payout amount is mentioned in the provided text. → thecyberexpress.com
2026-05-20 NEW 2026New NGINX Vulnerability Allows Remote Code Execution Attacks newsA newly discovered vulnerability in NGINX allows for remote code execution (RCE) attacks. The vulnerability, detailed in the linked article, presents a significant security risk to servers running the popular web server software. While the content highlights the exploit's potential, it does not mention a specific bug bounty payout amount. Users are advised to stay informed about patches and updates to mitigate this threat. → cyberpress.org
2026-05-20 NEW 2026PoC Exploit Released for 20-Year Old PostgreSQL RCE Vulnerability intermediateA Proof-of-Concept (PoC) exploit has been released for a 20-year-old remote code execution (RCE) vulnerability in PostgreSQL. This exploit targets a long-standing flaw, making it accessible to a wider range of attackers. While the content provides a link, it does not mention any specific bug bounty payout amounts. → cybersecuritynews.com
2026-05-20 NEW 2026Mozilla Products Multiple Vulnerabilities newsBulletin detailing multiple vulnerabilities affecting Mozilla Products including Firefox, Firefox ESR, Firefox for iOS, and Thunderbird. Exploitable by remote attackers, these issues can lead to denial of service, remote code execution, information disclosure, security restriction bypass, elevation of privilege, and spoofing. Specific CVEs such as CVE-2026-8388, CVE-2026-8391, and CVE-2026-8401 are listed, with patches available for affected versions including Firefox 151 and Thunderbird 151. → hkcert.org
2026-05-19 NEW 2026TP-Link Photoshop OpenVPN Norton VPN vulnerabilities newsWriteup detailing eight vulnerabilities in TP-Link Archer AX53 routers, including stack-based buffer overflow (CVE-2026-30814) and OS command injection (CVE-2026-30815, CVE-2026-30816, CVE-2026-30817, CVE-2026-30818, TALOS-2025-2307, TALOS-2025-2308, TALOS-2025-2309). It also covers privilege escalation in Adobe Photoshop via the Microsoft Store (CVE-2026-34632), a reachable assertion leading to DoS in OpenVPN (CVE-2026-35058), and privilege escalation in Norton VPN via the Microsoft Store (CVE-2025-58074). → blog.talosintelligence.com
2026-05-19 NEW 2026Unpatched ChromaDB Vulnerability Can Lead to Server Takeover newsWriteup of CVE-2026-45829, dubbed ChromaToast, a pre-authentication RCE vulnerability in ChromaDB. This flaw allows unauthenticated attackers to execute arbitrary code, gain shell access, and compromise sensitive data, including API keys and secrets. Exploitation involves tricking the server into downloading and executing a malicious HuggingFace model before authentication. The vulnerability affects ChromaDB versions since 1.0.0, with an estimated 73% of internet-accessible deployments exposed. HiddenLayer and researcher Azraelxuemo have reported the issue without response from Chroma. → securityweek.com
2026-05-19 NEW 2026Critical SEPPmail Gateway Flaws Allow Remote Code Execution and Mail Traffic Theft newsFlaws in SEPPmail Secure Email Gateway, including CVE-2026-2743 (pre-authenticated RCE via arbitrary file write) and CVE-2026-44128 (unauthenticated RCE through Perl code injection), permit remote code execution and mail traffic interception. Other vulnerabilities like CVE-2026-44127 (LFI) and CVE-2026-7864 (debug exposure) enable access to sensitive files and environment variables. These issues affect versions prior to the 15.x patched releases, allowing attackers to gain control, read or modify traffic, and access credentials. → cybersecuritynews.com
2026-05-19 NEW 2026PoC Code Published for Critical NGINX Vulnerability newsWriteup detailing CVE-2026-42945, a critical heap buffer overflow in NGINX's `ngx_http_rewrite_module` that can lead to denial-of-service or remote code execution. The vulnerability arises from a two-pass script engine process where an undersized buffer is allocated due to an unpropagated flag when a rewrite replacement contains a question mark. Exploitation involves manipulating request URIs with escapable characters to control the overflow size and employing cross-request heap feng shui to corrupt cleanup pointers for RCE. Patched versions include NGINX Plus 37.0.0 and NGINX open source 1.31.0. → securityweek.com
2026-05-19 NEW 2026Critical Marimo Security Vulnerability Enables Remote Code Execution Attacks newsVulnerability CVE-2026-39987 is a pre-authentication remote code execution flaw in Marimo versions ≤ 0.22.x, specifically within the `/terminal/ws` WebSocket endpoint. An attacker can exploit this by connecting to the unauthenticated endpoint, which spawns a system-level shell, enabling arbitrary command execution and potential deployment of malware like NKAbuse, with payloads hosted on Hugging Face Spaces. This critical gap in authentication allows attackers to gain full control of exposed systems, often used for AI and data science prototyping. → cybersecuritynews.com
2026-05-19 NEW 2026SEPPMail Secure E-Mail Gateway Vulnerabilities Enable RCE and Mail Traffic Access newsWriteup of SEPPMail Secure E-Mail Gateway vulnerabilities including CVE-2026-2743 for path traversal leading to RCE, CVE-2026-7864 for information exposure, CVE-2026-44125 for missing authorization, CVE-2026-44126 for deserialization, CVE-2026-44127 for path traversal and file deletion, CVE-2026-44128 for eval injection, and CVE-2026-44129 for template engine vulnerabilities. These flaws allow unauthenticated attackers to execute arbitrary code, read mail traffic, and gain network access, with some fixed in versions 15.0.2.1, 15.0.3, and 15.0.4. → thehackernews.com
2026-05-19 NEW 202620-Year-Old PostgreSQL Flaw Gets Public PoC Exploit for Remote Code Execution newsLibrary for exploiting CVE-2026-2005, a two-decade-old PostgreSQL flaw in the pgcrypto extension leading to remote code execution. This vulnerability allows attackers to achieve arbitrary read/write memory access via a heap-based buffer overflow in PGP session key parsing, ultimately escalating privileges to PostgreSQL superuser. The public PoC, demonstrating a multi-stage exploit that bypasses ASLR, leverages crafted PGP messages and PostgreSQL’s "COPY FROM PROGRAM" feature to execute arbitrary OS commands. → gbhackers.com
2026-05-19 NEW 2026Attackers are exploiting critical NGINX vulnerability (CVE-2026-42945) newsWriteup of CVE-2026-42945, a critical NGINX vulnerability dubbed NGINX Rift. Attackers are exploiting this memory corruption flaw to trigger denial-of-service conditions and potentially achieve unauthenticated remote code execution via crafted HTTP requests. The vulnerability affects NGINX Open Source and NGINX Plus, as well as certain F5 products, stemming from a bug in the `ngx_http_rewrite_module` and specifically triggered by rewrite directives with unnamed regex captures and question marks. Fixes are available for NGINX Open Source and Plus, with mitigations including the use of named captures. → helpnetsecurity.com
2026-05-19 NEW 2026SEPPmail Gateway Flaws Expose Organizations to RCE and Email Traffic Interception newsWriteup of SEPPmail Gateway vulnerabilities including CVE-2026-2743, CVE-2026-7864, CVE-2026-44127, and CVE-2026-44128, allowing pre-authenticated RCE via arbitrary file write in the LFT module and Perl code injection in the GINA v2 interface. Attackers can chain these flaws to gain full control of email gateways, intercept sensitive email traffic, and access confidential communications and credentials, posing significant risks to organizations, particularly in the DACH region. → gbhackers.com
2026-05-19 NEW 2026Critical n8n Vulnerabilities Expose Automation Nodes to Full RCE newsWriteup on critical n8n vulnerabilities CVE-2026-44789, CVE-2026-44790, and CVE-2026-44791, which allow attackers to achieve full remote code execution. These flaws impact the HTTP Request node via prototype pollution (CWE-1321), the Git node through argument injection (CWE-88) for arbitrary file reads, and the XML node with a patch bypass. Versions below 1.123.43, 2.20.7, and 2.22.1 are affected. → cybersecuritynews.com
2026-05-18 NEW 2026Hackers Actively Exploiting Critical NGINX RCE Vulnerability in the Wild newsWriteup on CVE-2026-42945, a critical NGINX heap buffer overflow vulnerability actively exploited in the wild. Researchers have observed real-world attacks allowing unauthenticated attackers to crash NGINX worker processes via crafted HTTP requests. While full remote code execution is unlikely due to ASLR, denial-of-service conditions are readily achievable. Exploitation requires specific NGINX rewrite configurations, but the large number of potentially vulnerable internet-facing NGINX servers necessitates urgent patching and mitigation. → cybersecuritynews.com
2026-05-18 NEW 2026Critical NGINX Vulnerability Lets Hackers Launch Remote Code Execution Attacks newsWriteup on CVE-2026-42945, a critical NGINX vulnerability allowing unauthenticated attackers to crash servers or execute remote code via specially crafted HTTP requests triggering a heap buffer overflow. Exploitation is possible under specific conditions, such as ASLR being disabled, and requires a particular rewrite configuration. Millions of NGINX servers are exposed, and active exploitation has been observed, necessitating prompt patching and configuration audits. → gbhackers.com
2026-05-18 NEW 2026Ivanti Fortinet SAP VMware n8n Patch RCE SQL Injection Privilege Escalation Flaws newsPatches released for Ivanti Xtraction (CVE-2026-8043), Fortinet (CVE-2026-44277, CVE-2026-26083), SAP (CVE-2026-34260, CVE-2026-34263), VMware Fusion (CVE-2026-41702), and n8n (CVE-2026-42231, CVE-2026-42232, CVE-2026-44791, CVE-2026-44789, CVE-2026-44790) address critical vulnerabilities including SQL injection, prototype pollution, authentication bypass, and privilege escalation. → thehackernews.com
2026-05-18 NEW 2026Marimo Security Flaw Enables remote code execution Attacks newsWriteup on CVE-2026-39987, a critical pre-authentication RCE in Marimo, a Python notebook framework, allowing unauthenticated attackers to hijack a live system shell via an unprotected `/terminal/ws` WebSocket endpoint. Exploitation can lead to full system compromise, data exfiltration, and lateral movement, especially in Dockerized AI/ML environments. A Nuclei detection template is available. All Marimo versions ≤ 0.22.x are affected; upgrade to 0.23.0 or later. → cyberpress.org
2026-05-18 NEW 2026Hackers Exploit Critical NGINX RCE Vulnerability in the Wild newsWriteup of CVE-2026-42945, "NGINX Rift," detailing a critical heap buffer overflow in the `ngx_http_rewrite_module`. This vulnerability, affecting numerous NGINX versions, enables remote code execution when ASLR is disabled and a denial-of-service condition via worker process crashes otherwise. Exploitation is actively occurring in the wild, with a proof-of-concept readily available. Patched versions of NGINX are now available, and Cloudflare has released a WAF rule update. → cyberpress.org
2026-05-18 NEW 2026Critical Marimo RCE Flaw Could Let Attackers Execute Malicious Code Remotely newsLibrary for mitigating CVE-2026-39987, a critical RCE flaw in the Marimo Python notebook framework. This vulnerability allows unauthenticated attackers to spawn a system-level shell via the `/terminal/ws` WebSocket endpoint, potentially leading to full infrastructure compromise. Exploitation has been observed with NKAbuse malware, leveraging simple WebSocket clients to execute commands. Affected Marimo versions prior to 0.23.0 require immediate upgrading, with interim mitigations including network access restrictions and non-root execution. → gbhackers.com
2026-05-18 NEW 2026n8n Security Flaws Could Let Attackers Achieve Remote Code Execution newsWriteup of n8n security flaws (CVE-2026-44789, CVE-2026-44790, CVE-2026-44791) detailing how prototype pollution, argument injection in the Git node, and patch bypass in the XML node can be chained for remote code execution. These critical vulnerabilities, requiring only low-privilege authenticated access, enable attackers to perform arbitrary file reads and compromise the entire n8n instance by manipulating workflow logic. → gbhackers.com
2026-05-18 NEW 2026Exploitation of Critical NGINX Vulnerability Begins newsWriteup detailing the active exploitation of CVE-2026-42945, known as Nginx Rift, a critical-severity heap buffer overflow in NGINX's `ngx_http_rewrite_module`. This vulnerability, present for 16 years and patched by F5, can lead to denial-of-service or remote code execution depending on system configurations like ASLR. VulnCheck warns that threat actors are already leveraging this flaw via crafted HTTP requests, with public proof-of-concept code enabling potential RCE and demanding urgent attention for affected NGINX deployments. → securityweek.com
2026-05-18 NEW 2026Experts warn of active exploitation of critical NGINX flaw CVE-2026-42945 newsWriteup of CVE-2026-42945, the "NGINX Rift" heap buffer overflow vulnerability affecting NGINX Plus and NGINX Open Source. Actively exploited shortly after disclosure, the flaw resides in `ngx_http_rewrite_module` and is triggered by specific rewrite directive configurations involving unnamed PCRE capture groups and question marks. While remote code execution is possible, it requires disabling Address Space Layout Randomization (ASLR) and knowledge of the vulnerable configuration, making widespread RCE attacks unlikely according to experts. → securityaffairs.com
2026-05-18 NEW 2026Claude Code Vulnerability Allows Attackers to Run Commands Through Crafted Deeplinks newsWriteup of Claude Code RCE vulnerability allowing arbitrary command execution via crafted deeplinks, exploiting a flaw in `eagerParseCliFlag` that mishandles `--settings=` within URL parameters. This technique, discovered by Joernchen, impacts Claude Code versions prior to 2.1.118 and demonstrates the risks of naive string parsing for CLI arguments, particularly when combined with deeplink handlers that inject user-controlled input into critical application logic. → gbhackers.com
2026-05-18 NEW 2026Claude Code RCE Vulnerability Allow Attackers Execute Commands via Malicious Deeplinks newsWriteup of RCE in Anthropic's Claude Code, allowing attackers to execute arbitrary shell commands via crafted `claude-cli://` deeplinks. The vulnerability, disclosed by Joernchen, exploited an `eagerParseCliFlag` function that naively processed `--settings=` flags embedded within deeplink parameters, bypassing workspace trust dialogs on macOS. Anthropic fixed the flaw in version 2.1.118. → cyberpress.org
2026-05-18 NEW 2026US cyber agency warns of active exploitation of Microsoft Exchange Server spoofing vulnerability newsCatalog entry for CVE-2026-42897, a Microsoft Exchange Server spoofing vulnerability allowing arbitrary JavaScript execution in Outlook Web Access. Exploitable via specially crafted emails, this cross-site scripting flaw has a CVSS score of 8.1 and is actively being exploited. Microsoft offers a temporary mitigation and is developing a permanent fix.
2026-05-18 NEW 2026Claude Code RCE Flaw Lets Attackers Execute Commands via Malicious Deeplinks newsLibrary for understanding the Claude Code RCE vulnerability, which allows arbitrary command execution through malicious deeplinks by exploiting a naive command-line argument parser. The flaw, identified by Joernchen of 0day.click and now patched in version 2.1.118, weaponizes the `claude-cli://` handler and bypasses workspace trust dialogs by injecting malicious `SessionStart` hooks into the `--prefill` parameter. The vulnerability highlights risks associated with context-blind argument parsing, particularly within deeplink handlers. → cybersecuritynews.com
2026-05-17 NEW 2026NGINX CVE-2026-42945 Exploited in the Wild Causing Worker Crashes and Possible RCE newsLibrary updates address critical NGINX CVE-2026-42945, a heap buffer overflow in ngx_http_rewrite_module causing worker crashes and potential RCE when ASLR is disabled. Also, two openDCIM vulnerabilities, CVE-2026-28515 (missing authorization) and CVE-2026-28517 (OS command injection), are actively exploited and can be chained with CVE-2026-28516 (SQL injection) for RCE, reportedly by attackers using AI tools like Vulnhuntr. → thehackernews.com
2026-05-17 NEW 2026CVE-2026-42945: NGINX Rewrite Heap Overflow Enables Remote DoS & Potential RCE newsWriteup of CVE-2026-42945, an NGINX rewrite heap overflow vulnerability, details its exploitation via crafted HTTP requests, particularly when using unnamed PCRE captures with a question mark in the replacement string. This flaw, present in versions from 0.6.27 through 1.30.0, can lead to Denial of Service through worker crashes or potential Remote Code Execution, especially with ASLR disabled. A proof-of-concept demonstrating RCE has been published. → socradar.io
2026-05-16 NEW 2026Microsofts Patch Tuesday Update Targets 120 Security Flaws newsMicrosoft's latest Patch Tuesday update addresses 120 security vulnerabilities, a significant release aimed at bolstering system security. This update is critical for users to install to protect their systems from potential exploits. The specific details of each vulnerability and the affected products are available in Microsoft's official release notes. The content does not mention any specific bug bounty payout amounts.
2026-05-15 NEW 2026A remote code execution vulnerability has been discovered in NGINX; the affected versions are listed below. newsWriteup of CVE-2026-42945, an 18-year-old heap buffer overflow in NGINX, enabling unauthenticated remote code execution when specific rewrite, if, or set directives are used with unnamed PCRE capture groups. DepthFirst's analysis highlights memory corruption issues, with potential exploitation on systems lacking ASLR. The vulnerability's severity is rated differently by NGINX (medium) and NIST (critical/high), depending on exploitability conditions. Affected users should update NGINX and review configurations for vulnerable directive combinations.
2026-05-15 NEW 2026Amazon Redshift JDBC Driver Flaws Enable Remote Code Execution newsAmazon Redshift JDBC Driver Flaws Enable Remote Code Execution https://ift.tt/dWiYtcb → cyberpress.org
2026-05-15 NEW 2026Nginx Remote Code Execution Vulnerability (CVE-2026-42945) Notice newsNginx has a critical remote code execution (RCE) vulnerability, tracked as CVE-2026-42945. This flaw allows attackers to execute arbitrary code on affected Nginx servers. The exact impact and exploitability details are still emerging, but it represents a significant security risk for websites and applications relying on Nginx. Users are advised to monitor official Nginx advisories for patches and mitigation strategies. No bug bounty payout amount is mentioned in this notice. → securityboulevard.com
2026-05-15 NEW 2026Google Chrome Multiple Vulnerabilities newsWriteup detailing multiple vulnerabilities in Google Chrome, affecting versions prior to 148.0.7778.167 (Linux) and 148.0.7778.167/168 (Mac/Windows). Exploitation of these CVEs, including CVE-2026-8509 through CVE-2026-8587, could lead to remote code execution, denial of service, security restriction bypass, spoofing, cross-site scripting, and information disclosure. Users are advised to update to the patched versions. → hkcert.org
2026-05-14 NEW 2026Critical NGINX Rift vulnerability discovered present for 18 years newsWriteup of CVE-2026-42945, NGINX Rift, a critical heap buffer overflow vulnerability in NGINX Plus and Open Source affecting versions 0.6.27 through 1.30.0 and R32 through R36. Triggered by specific rewrite directives with unnamed PCRE capture groups and a question mark in the replacement string, exploitation can lead to remote code execution or denial-of-service. Patches were released April 21, 2026. → scworld.com
2026-05-14 NEW 2026AI agent finds 18-year-old remote code execution flaw in Nginx newsTool for finding vulnerabilities, this LLM-powered system discovered four bugs in Nginx, including CVE-2026-42945, a critical heap buffer overflow in the `ngx_http_rewrite_module` that allows for remote code execution by exploiting specific rewrite directive configurations. This flaw, impacting Nginx versions 0.6.27 to 1.30.0 and Nginx Plus, was patched in later releases. Additional vulnerabilities CVE-2026-42946, CVE-2026-42934, and CVE-2026-40701 were also identified, leading to denial of service, memory leaks, or data modification. → csoonline.com
2026-05-14 NEW 2026CVE-2026-42945: Critical NGINX Rewrite Flaw newsWriteup detailing CVE-2026-42945, an 18-year-old heap buffer overflow in NGINX's ngx_http_rewrite_module. This critical vulnerability, also known as NGINX Rift, affects NGINX Open Source (0.6.27-1.30.0) and NGINX Plus (R32-R36), enabling denial of service or potential remote code execution via crafted HTTP requests. Exploitation occurs when rewrite directives use unnamed PCRE captures with a replacement string containing a question mark, followed by specific other directives. Mitigation involves upgrading to patched versions or temporarily replacing unnamed captures with named ones.
2026-05-14 NEW 2026Critical Canon MailSuite Vulnerability Enables Remote Code Execution Attacks newsA critical vulnerability has been discovered in Canon MailSuite software that allows attackers to execute arbitrary code remotely. This means malicious actors could potentially take control of affected systems by exploiting this flaw. Further details on the vulnerability and its impact are available at the provided link. No bug bounty payout amount is mentioned in the content. → cybersecuritynews.com
2026-05-14 NEW 2026Critical Windows DNS Client Flaw Enables Remote Code Execution newsA critical vulnerability in the Windows DNS client allows for remote code execution, meaning attackers can potentially gain control of a user's computer without any interaction. This is achieved by sending specially crafted DNS responses. The flaw is present in various Windows versions, and Microsoft has released security updates to address it. Users are strongly advised to install these updates promptly to protect their systems from this severe threat. → cyberpress.org
2026-05-14 NEW 2026Critical MongoDB Vulnerability Allow Attackers to Execute Arbitrary Code newsA critical vulnerability has been discovered in MongoDB that allows attackers to execute arbitrary code on affected systems. This significant security flaw poses a serious risk to data confidentiality and system integrity. Users are strongly advised to update their MongoDB installations to the latest patched version immediately to mitigate this threat. Further details on the exploit are available through the provided link. → cybersecuritynews.com
2026-05-14 NEW 2026ThreatsDay Bulletin: PAN-OS RCE Mythos cURL Bug AI Tokenizer Attacks and 10 Stories newsLibrary for threat intelligence, detailing exploited PAN-OS RCE (CVE-2026-0300) with EarthWorm and ReverseSocks5 payloads, private AI chats leveraging Trusted Execution Environments for Meta AI, a zero-auth data leak impacting Schemata's AI training platform, the FCC's router update deadline extension, Operation GriefLure's APT phishing targeting Vietnam and Philippines with RATs, a multi-stage intrusion using weaponized PowerShell disguised as JPEGs for ConnectWise ScreenConnect, an aid-themed infostealer using LNK files and Python implants, GhostLock's PoC demonstrating denial of file access via SMB share locking, AI scan results for cURL identifying a low-severity bug, and an MoU between Indian agencies for fraud-risk intelligence sharing. → thehackernews.com
2026-05-14 NEW 202618-year-old NGINX vulnerability allows DoS potential RCE newsLibrary for detecting CVE-2026-42945, an 18-year-old heap buffer overflow in NGINX's ngx_http_rewrite_module, which can lead to denial of service and, under specific conditions like disabled ASLR, remote code execution. This flaw, affecting versions 0.6.27 through 1.30.0, arises from inconsistent state handling during URI processing when 'rewrite' and 'set' directives are used together. The library would likely target this vulnerability and potentially the three other memory corruption issues (CVE-2026-42946, CVE-2026-40701, CVE-2026-42934) discovered alongside it. → bleepingcomputer.com
2026-05-14 NEW 2026Critical Exim vulnerability allows remote code execution newsWriteup of CVE-2026-45185, a critical user-after-free vulnerability in Exim mail transfer agent impacting versions prior to 4.99.3 that use GnuTLS with STARTTLS and CHUNKING enabled. This flaw allows unauthenticated remote attackers to execute arbitrary code by exploiting a condition during the TLS shutdown process with chunked SMTP traffic. OpenSSL builds are unaffected. The vulnerability, discovered by Federico Kirschbaum, has a fix available in Exim 4.99.3. → scworld.com
2026-05-14 NEW 2026Windows DNS Client Security Flaw Exposes Systems to Remote Code Execution newsA critical security vulnerability has been discovered in the Windows DNS client that could allow remote attackers to execute arbitrary code on affected systems. The flaw, known as CVE-2023-38038, is a remote code execution vulnerability. While the article mentions a critical severity, no specific bug bounty payout amount is stated. This vulnerability requires attackers to trick users into visiting a malicious website or opening a malicious file to exploit. Microsoft has released security updates to address this issue. → gbhackers.com
2026-05-14 NEW 2026New Exim Vulnerability Enables Arbitrary Code Execution Attacks newsA critical vulnerability in Exim, a widely used Mail Transfer Agent, has been discovered. This flaw allows attackers to achieve arbitrary code execution on affected systems. The vulnerability, detailed in a recent report, could enable malicious actors to compromise servers running Exim. No specific payout amount for reporting this bug was mentioned in the provided content. → cyberpress.org
2026-05-14 NEW 2026Critical Exim Mailer Flaw Enables Remote Code Execution Attacks newsA critical vulnerability has been discovered in Exim Mailer, a widely used mail transfer agent. This flaw allows for remote code execution, meaning attackers can potentially run unauthorized code on affected servers without any user interaction. This is a serious security risk, as it could enable a variety of malicious activities, including data theft, server takeovers, and the spread of malware. Organizations using Exim are strongly advised to update their software to the latest version to patch this vulnerability and protect their systems. No bounty payout amount is mentioned in the provided content. → gbhackers.com

Related Topics

SSRF 1053 resources Server-side requests to unintended internal targets SQLi 144 resources Database injection through unsanitized query parameters XXE 86 resources XML parser exploitation for file read and SSRF XSS 452 resources Client-side injection through untrusted input in web pages
Compare: SAST vs DAST · WAF vs RASP

Frequently Asked Questions

What is remote code execution?
Remote Code Execution (RCE) is a vulnerability that allows an attacker to run arbitrary commands or code on a target system. It is the most critical class of security vulnerability because it gives the attacker the same level of access as the application or server process, often leading to complete system compromise.
What are common RCE attack vectors?
Common vectors include command injection (unsanitized input passed to shell commands), unsafe deserialization (Java, PHP, Python, .NET), Server-Side Template Injection (Jinja2, Twig, Freemarker), file upload bypasses that execute uploaded code, expression language injection in Java frameworks, and prototype pollution in Node.js leading to code execution.
Why does RCE pay the highest bug bounties?
RCE represents total system compromise — an attacker can read all data, modify the application, pivot to internal networks, and potentially access cloud infrastructure. The impact is maximum, so bounty programs consistently pay their highest rewards for RCE findings, often ranging from $10,000 to $100,000+ depending on the target.

Weekly AppSec Digest

Get new resources delivered every Monday.