The newest Remote Code Execution (RCE) resources are on the Remote Code Execution (RCE) page. For a reading order instead of a date order, see the Remote Code Execution (RCE) learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-07-13 2026 | iCagenda and Balbooa Forms Joomla Flaws Reportedly Exploited as Zero-Days news 3 min read | Writeup on zero-day exploits targeting Joomla extensions iCagenda (CVE-2026-48939) and Balbooa Forms (CVE-2026-56291). Both vulnerabilities allow arbitrary file uploads, leading to remote code execution. Exploitation was observed since June 2026 and July 2026 respectively, affecting unpatched versions of these extensions. CISA has added these to its KEV catalog due to active exploitation in the wild. Updates have been released to address these critical flaws. → thehackernews.com |
| 2026-07-13 2026 | Palo Alto Products Multiple Vulnerabilities news 1 min read | Writeup of multiple vulnerabilities affecting Palo Alto Products including Cloud NGFW, PAN-OS (versions 10.2, 11.1, 11.2, 12.1), and Prisma Access. Exploitable conditions include remote code execution, denial of service, security restriction bypass, cross-site scripting, information disclosure, and data manipulation, impacting various versions. Specific CVEs identified are CVE-2026-0279 through CVE-2026-0288. → hkcert.org |
| 2026-07-12 2026 | Critical CVE-2026-2699 and CVE-2026-2701 Vulnerabilities Force Immediate Shutdown of Progress ShareFile Storage Zone Controller v5.x news 3 min read | Writeup detailing critical vulnerabilities CVE-2026-2699 and CVE-2026-2701 impacting Progress ShareFile Storage Zone Controller v5.x. These flaws allow unauthenticated remote attackers to access configuration pages and achieve remote code execution, enabling potential system compromise. The vulnerabilities are linked to MITRE ATT&CK techniques T1190, T1078, and T1059. Progress Software issued an urgent shutdown directive for affected on-premises deployments due to the severe risk, with no patch currently available. → rescana.com |
| 2026-07-12 2026 | Global CMS Attack Wave: Attackers Distribute Web Shells via Known WordPress Joomla and Craft Vulnerabilities news 4 min read | Analysis of a global CMS attack wave exploiting known vulnerabilities in WordPress, Joomla, Craft CMS, MaxSite CMS, and MetInfo CMS. Attackers leverage issues like CVE-2026-0740 in Ninja Forms File Uploads and CVE-2025-32432 in Craft CMS to deploy web shells, leading to potential credential harvesting, malware distribution, and internal system compromise. The campaign emphasizes the critical need for prompt patching and thorough post-compromise investigation, including file and log analysis, to remove persistence mechanisms and restore compromised systems. |
| 2026-07-10 2026 | Zero Day Initiative CVE-2026-47291: Remote Code Execution in the Windows HTTP.sys news 6 min read | Writeup detailing CVE-2026-47291, a kernel-mode remote code execution vulnerability in Windows HTTP.sys. Exploitation involves an attacker sending crafted HTTP/1.x requests over TLS, triggering a heap buffer overflow during header parsing due to insufficient bounds checking when growing a buffer reference array. This can lead to denial-of-service or code execution with kernel privileges. The vulnerability is mitigated by configuring `MaxRequestBytes` to 65,535 or lower, and detection requires monitoring TLS-encrypted traffic for an unusually high number of HTTP header lines per request. |
| 2026-07-10 2026 | Researcher Details WhatsApp-to-Host Attack Chain Using Three OpenClaw Flaws advanced 2 min read | Writeup detailing a WhatsApp-to-host attack chain leveraging three OpenClaw vulnerabilities: GHSA-hjr6-g723-hmfm and GHSA-9969-8g9h-rxwm, both involving OS command injection and incomplete input validation in the host execution environment filtering; and GHSA-575v-8hfq-m3mc, a path traversal flaw enabling sandbox bind mount bypass. These flaws allow for credential theft, privilege escalation, and arbitrary code execution without prior host compromise, as demonstrated by accessing sensitive user files or the Docker socket. → thehackernews.com |
| 2026-07-08 2026 | Attackers using Langflow flaw for credential harvesting (CVE-2026-55255) news 2 min read | Writeup on CVE-2026-55255, an insecure direct object reference (IDOR) vulnerability in Langflow versions prior to 1.9.2. This flaw allows an authenticated attacker to execute any user's flow by supplying its ID, leading to credential harvesting, cross-tenant data exposure, and secret theft, as demonstrated by attackers exploiting it alongside CVE-2026-33017 for code execution and implant delivery. CISA has mandated federal agencies patch this vulnerability by July 10, 2026. → helpnetsecurity.com |
| 2026-07-07 2026 | RCE via Gemini Live AI Voice Session Misconfiguration. advanced 10 min read AI | Library for exploiting RCE vulnerabilities in applications integrating Google's Gemini Live AI Voice sessions by injecting client-controlled setup frames. The vulnerability arises when ephemeral tokens, used for browser-facing WebSocket connections to endpoints like `BidiGenerateContentConstrained`, are issued without proper `live_connect_constraints`. This misconfiguration allows attackers to control session parameters, including the model, system instruction, and critically, the `tools` field, enabling the injection of code execution capabilities. The writeup details how the official Gemini Live API example repository promotes this insecure pattern by omitting the `bidi_generate_content_setup` from token creation. → infosecwriteups.com |
| 2026-07-03 2026 | Critical Cursor AI IDE Flaws Could Lead to OS-Level Remote Code Execution news 2 min read | Writeup detailing CVE-2026-50548 and CVE-2026-50549, dubbed DuneSlide, which allow OS-level remote code execution in the Cursor AI IDE. These flaws leverage unchecked terminal command execution and symbolic link vulnerabilities to bypass sandbox restrictions, enabling attackers to overwrite critical executables or write to arbitrary locations by manipulating path resolution logic when processing user prompts. Patches are available in Cursor 3.0. → securityweek.com |
| 2026-07-03 2026 | WinRAR flaw could allow attackers to take control of your computer news 2 min read | Writeup on CVE-2026-14191, a WinRAR vulnerability allowing remote code execution via crafted RAR5 recovery-volume (.rev) files. This bug, similar to CVE-2023-40477, exploits how WinRAR handles these repair files to write data outside allocated memory, potentially enabling attackers to run malicious code. The advisory urges users to manually update WinRAR to version 7.23, as automatic updates are not supported, and highlights the risk posed by the lack of timely updates, referencing past exploitation of similar WinRAR flaws by state-aligned groups. |
| 2026-07-03 2026 | It’s 37oC, And All We Can Think About Is ColdFusion (Adobe ColdFusion Security Bulletin APSB26-68 CVE Bonanza) - watchTowr Labs news 9 min read | Analysis of CVE-2026-48282 and CVE-2026-48313 details how Adobe ColdFusion's Remote Development Services (RDS) feature, when authentication is disabled, allows for arbitrary file reads and writes through an RPC protocol. The vulnerability arises from insufficient path validation in the `FileReadOperator` and `FileWriteOperator` methods, which were previously addressed by introducing `RdsFileSecurity.resolveCanonical` to enforce stricter path checks. → labs.watchtowr.com |
| 2026-07-02 2026 | Why Being in the Docker Group Is a Backdoor to Your Whole System intermediate AuthZ | Library explaining how membership in the `docker` group on Linux grants users root privileges on the host system without explicit `sudo` access. It details how this is an intended consequence of Docker's design, not a vulnerability, and provides a proof of concept demonstrating this capability. Administrators are advised on mitigation strategies to prevent this elevated access. → infosecwriteups.com |
| 2026-07-02 2026 | Sandbox bypass flaws in Cursor IDE highlight prompt injection as an RCE vector intermediate 3 min read | Writeup of CVE-2026-50548 and CVE-2026-50549 in Cursor IDE, detailing how prompt injection bypasses the command execution sandbox via a `working_directory` parameter override and symlink canonicalization fallbacks. These vulnerabilities, collectively dubbed DuneSlide by researchers, allow attackers to achieve remote code execution (RCE) by writing malicious scripts or overwriting executables outside the intended project directory, highlighting systemic risks in AI-assisted development tools. → csoonline.com |
| 2026-06-30 2026 | CVE-2026-55200: Critical libssh2 Client-Side SSH Vulnerability Exposes Curl Git PHP to Remote Code Execution Risk news 4 min read | Library detailing CVE-2026-55200, a critical out-of-bounds write vulnerability in libssh2 client-side SSH. This flaw allows a malicious SSH server to trigger memory corruption and potential remote code execution on clients using affected versions up to 1.11.1. The widespread use of libssh2 in tools like curl, Git, and PHP amplifies the risk. A public proof-of-concept exploit exists, increasing the likelihood of exploitation. → rescana.com |
| 2026-06-30 2026 | Langflow RCE Exploited to Deploy Monero Miner on Exposed AI App Endpoints intermediate 3 min read | Library that exploits CVE-2026-33017, a critical unauthenticated RCE vulnerability in Langflow, to deploy a Monero cryptocurrency miner. Attacks target exposed AI application endpoints, leveraging a single line of Python code to download and execute a shell script that fetches a miner binary. This payload terminates rival miners, disables security controls, establishes persistence via cron jobs, and spreads via SSH keys, impacting AI application infrastructure as a new attack vector. → thehackernews.com |
| 2026-06-30 2026 | Critical Remote Code Execution Vulnerability in libssh2 Client Library Require Urgent Mitigation news 3 min read | Library with critical vulnerabilities impacting libssh2, including CVE-2026-55200, a pre-authentication RCE due to a memory corruption bug in ssh2_transport_read(). Exploitable via a crafted packet from a malicious SSH server, this flaw affects widely used tools like curl and Git GUI clients. Urgent mitigation involves inventorying libssh2 usage, applying patches like commit 97acf3df, and restricting outbound SSH client connectivity to trusted endpoints. → arcticwolf.com |
| 2026-06-30 2026 | Enterprise Tech In, Shell Out (Progress Kemp LoadMaster Uninitialized Heap to Pre-Auth RCE CVE-2026-8037) - watchTowr Labs intermediate 13 min read | Writeup on CVE-2026-8037, an uninitialized heap to pre-authentication Remote Code Execution vulnerability in Progress Kemp LoadMaster. The vulnerability arises from improper handling of user input within the `escape_quotes` function, which fails to null-terminate an allocated buffer. This can lead to information disclosure or code execution when the uninitialized memory is later processed by the API. The writeup details the vulnerability's mechanism and the specific code changes introduced in the patch. → labs.watchtowr.com |
| 2026-06-29 2026 | Enterprise Tech In Shell Out (Progress Kemp LoadMaster Uninitialized Heap to Pre-Auth RCE CVE-2026-8037) news 13 min read | Writeup detailing CVE-2026-8037, a pre-authentication Remote Code Execution vulnerability in Progress Kemp LoadMaster. The vulnerability stems from an uninitialized heap buffer used in the `escape_quotes` function, which fails to properly sanitize user input and lacks a null terminator. Exploiting this flaw allows an attacker to gain control of the system by crafting malicious API requests. → labs.watchtowr.com |
| 2026-06-27 2026 | MCP Auto-Execution: From Git Clone to Cloud Compromise in Amazon Q VS Code Extension advanced 6 min read AI | Tool for arbitrary code execution and cloud credential theft; Amazon Q Developer Extension for VS Code automatically loaded MCP server configurations from workspace files without user consent, enabling immediate code execution upon opening a malicious repository. This vulnerability, similar to others found in AI coding tools, exploited the Model Context Protocol's convenience features and environment inheritance risks. Amazon has remediated this issue in language server version 1.65.0. → wiz.io |
| 2026-06-27 2026 | Intigriti Bug Bytes #237 - June 2026 🚀 news 10 min read AuthZ Bug Bounty | Library of AI-focused security discussions and tools, including interviews with researchers on using AI smartly in offensive security, securing AI systems, and the human element in AI adoption. It highlights Intigriti Quick Scope (IQS), a Burp Suite extension, and mentions AFL++ and Metis for fuzzing and LLM-powered code review. The entry also covers vulnerabilities like RCE in phpBB and CSP bypasses, along with winning the PortSwigger Burp Suite Extension Award and being named Best Security Company at the 2026 SC Awards Europe. → intigriti.com |
| 2026-06-25 2026 | CVE-2026-1606: Code Injection Vulnerability in GitLab CE/EE Snippets Affected Versions Risks and Remediation Steps intermediate 3 min read | Writeup detailing CVE-2026-1606, a code injection vulnerability (CWE-94) in GitLab CE/EE Snippets. Affecting versions 14.8 through 19.1.0, it allows authenticated users to conceal content due to insufficient input validation. While not enabling arbitrary code execution, this medium-severity flaw (CVSS 4.3) risks project data integrity. Patched versions include 18.11.6, 19.0.3, and 19.1.1. No active exploitation or APT group activity has been reported. → rescana.com |
| 2026-06-24 2026 | New Cisco RCE was fixed news | New Cisco RCE was fixed |
| 2026-06-24 2026 | High severity vulnerability found in libcurl and curl (CVE-2023-38545) news 5 min read | Writeup on CVE-2023-38545, a high-severity heap-based buffer overflow in libcurl and curl, released October 2023. This vulnerability, impacting numerous open source ecosystems and Linux distributions, requires specific exploit conditions like interacting with compromised servers or using attacker-controlled SOCKS5 proxy URLs. Snyk offers reporting features to identify affected projects by CVE number. → snyk.io |
| 2026-06-24 2026 | FFmpeg PixelSmash Vulnerability Enables Remote Code Execution news 3 min read | Writeup on CVE-2026-8461, the "PixelSmash" vulnerability, details how a flaw in FFmpeg's MagicYUV decoder allows remote code execution via specially crafted media files. This critical vulnerability, with a CVSS score of 8.8, affects numerous FFmpeg-dependent applications like Jellyfin and Nextcloud, and can be triggered by automated processes such as thumbnail generation or metadata extraction. Researchers successfully demonstrated RCE and denial-of-service conditions across various products including Kodi, mpv, and OBS Studio. Mitigation strategies include patching FFmpeg, disabling unnecessary codecs, restricting media uploads, and isolating media-processing workloads. → esecurityplanet.com |
| 2026-06-24 2026 | FFmpeg PixelSmash Flaw Allows RCE on Video Players Media Servers NAS Appliances news 2 min read | Library for detecting and mitigating CVE-2026-8461, a critical heap out-of-bounds write vulnerability dubbed PixelSmash within FFmpeg's MagicYUV decoder. This flaw, present in numerous video players, media servers, and NAS appliances, enables attackers to achieve remote code execution (RCE) by delivering a crafted media file, potentially leading to zero-click attacks. The library aids in identifying vulnerable FFmpeg builds and understanding the exploit vector, which involves targeting the AVBuffer struct to inject shell commands before the inevitable process crash. → securityweek.com |
| 2026-06-23 2026 | Leaky Vessels: runC and BuildKit container escape vulnerabilities - everything you need to know intermediate 10 min read Supply Chain | Writeup detailing "Leaky Vessels," container escape vulnerabilities in runC (CVE-2024-21626) and BuildKit (CVE-2024-23651, CVE-2024-23652, CVE-2024-23653). The runC flaw allows host filesystem access via leaked file descriptors, posing significant risk to Kubernetes and build pipelines. BuildKit issues involve race conditions and mount feature manipulation enabling host file modification or deletion, or elevated container privileges when using the security.insecure entitlement. The analysis highlights affected Linux distributions and cloud providers, emphasizing the widespread risk and advising immediate patching. → wiz.io |
| 2026-06-23 2026 | PixelSmash – Critical FFmpeg Vulnerability Turns Media Files into Weapons news 17 min read | Tool for detecting PixelSmash (CVE-2026-8461), a critical FFmpeg vulnerability enabling remote code execution via crafted media files. This heap out-of-bounds write affects hundreds of applications like Jellyfin, Nextcloud, Kodi, and mpv by exploiting the MagicYUV decoder's handling of slice heights, leading to crashes or arbitrary code execution when processing malicious AVI, MKV, or MOV files. → jfrog.com |
| 2026-06-22 2026 | FFmpeg PixelSmash bug triggers code execution on media file open intermediate 2 min read | Library for FFmpeg's CVE-2026-8461, "PixelSmash," a critical heap out-of-bounds write vulnerability in the MagicYUV decoder. This flaw allows remote code execution through specially crafted media files like AVI, MKV, or MOV, impacting numerous downstream applications including Kodi, OBS Studio, Jellyfin, and Nextcloud. Exploitation involves overwriting function pointers within FFmpeg's heap structures, enabling arbitrary command execution. The vulnerability was patched in FFmpeg 8.1.2. |
| 2026-06-22 2026 | Microsoft fixes AutoGen Studio flaw that enabled code execution news 2 min read | Writeup of AutoJack, a vulnerability chain in Microsoft's AutoGen Studio, detailing how attackers could manipulate AI agents into executing arbitrary commands. The chain exploits weaknesses in WebSocket trust, authentication middleware, and URL parameter handling to enable remote code execution by tricking a browsing agent into loading malicious JavaScript. Microsoft remediated the flaw before its PyPI release, limiting exposure to developers building from source during a specific window. → bleepingcomputer.com |
| 2026-06-22 2026 | [News] RCE found in Meccha Chameleon news 5 min read | Writeup detailing a Remote Code Execution (RCE) vulnerability in the game Meccha Chameleon, specifically within its custom map functionality. The vulnerability arises from the game's Blueprint scripting system executing arbitrary code via the `LaunchURL` function, which internally uses `ShellExecuteW`. Attackers can craft malicious custom maps containing a batch file in a predictable Steam Workshop content directory. When a user subscribes to this map, the batch file is automatically executed, leading to arbitrary command execution on the victim's machine. The article highlights the risk of user-generated content and recommends allowlisting asset file types and restricting Blueprint usage. |
| 2026-06-22 2026 | Backdoor in XZ Utils allows RCE: everything you need to know news 8 min read Supply Chain | Analysis of CVE-2024-3094, a critical RCE vulnerability in XZ Utils versions 5.6.0 and 5.6.1, detailing the supply chain compromise. The backdoor, injected via obfuscated test files during compilation on specific Linux distributions, targets liblzma and can affect OpenSSH, leading to remote code execution. Exploitation requires specific runtime conditions, including the absence of the TERM environment variable and targeting of the sshd binary. Mitigation involves downgrading XZ Utils versions and hunting for suspicious activity. → wiz.io |
| 2026-06-22 2026 | CVE-2024-4040 exploited in the wild: everything you need to know news 2 min read | Writeup detailing CVE-2024-4040, a critical vulnerability in CrushFTP versions prior to 10.7.1 and 11.1.0. Initially described as a VFS sandbox escape allowing arbitrary file reads, researchers found it enables unauthenticated remote code execution and administrator bypass. Exploited in the wild, this flaw, potentially a server-side template injection, affects 1.7% of cloud environments. Updating to patched versions is crucial, as previous mitigation advice regarding DMZs has been retracted. → wiz.io |
| 2026-06-22 2026 | Code injection in Python: examples and prevention beginner 7 min read Python | Library that details code injection vulnerabilities in Python, covering insecure use of functions like `eval()` and dynamic code construction. It explains risks associated with user-controlled inputs, lack of validation, and insecure deserialization, providing mitigation techniques such as allowlisting, using `literal_eval()`, parameterized queries, and secure deserialization practices. The library also emphasizes secure coding conventions and the use of developer security tools like Snyk to identify and fix issues. → snyk.io |
| 2026-06-22 2026 | AutoJack: How a single page can RCE the host running your AI agent intermediate 16 min read | Technique AutoJack demonstrates how a single web page can achieve remote code execution on the host running an AI agent, specifically targeting AutoGen Studio. By exploiting three weaknesses in the Model Context Protocol (MCP) WebSocket — an origin allowlist easily bypassed by an agent, opt-out authentication middleware, and unvalidated `server_params` from the URL—an attacker can trick the browsing agent into executing arbitrary commands on the host. This crosses the localhost trust boundary, turning the agent into a delivery vehicle for RCE. → microsoft.com |
| 2026-06-21 2026 | Active Exploitation of Critical CVE-2026-20253 in Splunk Enterprise: Unauthenticated RCE via PostgreSQL Sidecar Service news 4 min read | Writeup detailing active exploitation of CVE-2026-20253 in Splunk Enterprise, a critical vulnerability allowing unauthenticated remote code execution via the PostgreSQL Sidecar Service. This flaw, cataloged by CISA, enables attackers to create or truncate arbitrary files by abusing backup and restore endpoints, leading to potential system compromise. The article covers exploitation mechanics, including chaining operations to write malicious scripts, and provides example exploit requests, detection indicators, and mitigation steps like upgrading Splunk or disabling the affected service. → rescana.com |
| 2026-06-21 2026 | Windows Server 2016 Security Update Failures and CVE-2024-49116 RCE Vulnerability: Analysis and Mitigation Strategies news 4 min read | Analysis of CVE-2024-49116, a critical RCE vulnerability in Windows Remote Desktop Services, details use-after-free and race condition flaws exploitable by unauthenticated requests. This entry also addresses Windows Server 2016 update failures leading to domain controller restarts, resolved by KB5091572. Mitigation strategies include applying December 2024 security updates, disabling Remote Desktop Gateway services, restricting network access, and enabling NLA. Affected versions span Windows Server 2016 through 2025. → rescana.com |
| 2026-06-21 2026 | Active Exploitation Alert: Critical CVE-2026-42945 NGINX Rift Vulnerability in NGINX and F5 ProductsPatch Immediately news 5 min read | Writeup of CVE-2026-42945, dubbed "NGINX Rift," a critical heap-based buffer overflow in NGINX and F5 products. This vulnerability, affecting numerous NGINX Open Source and Plus versions, enables unauthenticated remote code execution and denial-of-service via crafted HTTP requests, particularly when using rewrite and set directives. A public PoC exploit exists, and active exploitation is confirmed. Related vulnerabilities include CVE-2026-42946 and CVE-2026-40701. Mitigation involves immediate patching or replacing unnamed PCRE captures with named ones. → rescana.com |
| 2026-06-21 2026 | Chaining Security Bugs in Discuz! X5.0: from Race Condition to Pre-Auth RCE advanced 28 min read | Library for chaining vulnerabilities in Discuz! X5.0, demonstrating a pre-authentication RCE attack. The exploit combines a Cross-Context Token Reuse leading to a Race Condition and Authentication Bypass, a custom OCR model for CAPTCHA bypass, and an administrative Local File Inclusion (LFI) vulnerability to achieve full server control. |
| 2026-06-21 2026 | Critical RCE vulnerability in PHP CGI: everything you need to know news 3 min read | Writeup of CVE-2024-4577, a critical RCE in PHP CGI, details its exploitation by TellYouThePass ransomware via argument injection on Windows systems. The vulnerability, particularly affecting Chinese and Japanese locales, leverages Windows' Best-Fit encoding feature to bypass previous protections. Affected PHP versions include 8.3 before 8.3.8, 8.2 before 8.2.20, and 8.1 before 8.1.29, as well as end-of-life versions. Mitigation involves upgrading PHP, applying temporary rewrite rules, or disabling CGI for XAMPP installations. → wiz.io |
| 2026-06-21 2026 | Probllama: Ollama Remote Code Execution Vulnerability (CVE-2024-37032) – Overview and Mitigations news 6 min read AI | Writeup of CVE-2024-37032, "Probllama," a Remote Code Execution vulnerability in Ollama, the popular open-source AI model deployment tool. The vulnerability stems from insufficient input validation in the `/api/pull` endpoint, allowing path traversal to overwrite arbitrary files. This can be leveraged to achieve arbitrary file reads and ultimately remote code execution, particularly in Docker deployments where the server runs with root privileges. Users are advised to upgrade to Ollama version 0.1.34 or newer. → wiz.io |
| 2026-06-21 2026 | RCE vulnerability in OpenSSH: everything you need to know news 3 min read | Library detailing CVE-2024-6387, a critical RCE-as-root vulnerability in OpenSSH (sshd) dubbed "regreSSHion." This signal handler race condition affects default configurations on 32-bit glibc-based Linux distributions, potentially leading to heap corruption and arbitrary code execution. Exploitation requires specific environmental conditions, making widespread attacks unlikely but possible against targeted, patient adversaries. Patches are available for affected versions, and organizations should upgrade and restrict internet-facing SSH access. → wiz.io |
| 2026-06-21 2026 | Command injection in Python: examples and prevention beginner 10 min read Python | Library for preventing command injection in Python, detailing vulnerabilities arising from insecure use of `os.system`, `subprocess.run` with `shell=True`, dynamic command construction, and `eval()`. It highlights examples like MLflow and PaddlePaddle, and emphasizes mitigation through strict input validation, sanitization, and the use of parameterized queries to protect against unauthorized command execution and system compromise. → snyk.io |
| 2026-06-21 2026 | Krampus delivers an end-of-year Struts vulnerability news 7 min read | Analysis of CVE-2023-50164, a critical Struts path traversal vulnerability, with a proof-of-concept exploit. This vulnerability allows attackers to upload files to arbitrary locations within an application's web-served directories, potentially leading to remote code execution. The article details remediation steps, including upgrading Struts to version 2.5.33 or 6.3.0.2 and implementing custom code checks using Snyk's SAST and SCA tools to prevent malicious file uploads and identify vulnerable dependencies. → snyk.io |
| 2026-06-20 2026 | Use-after-free in the QPACK encoder of nginx HTTP/3 - CVE-2026-42530 advanced 5 min read | Writeup detailing CVE-2026-42530, a use-after-free vulnerability impacting the QPACK encoder within nginx's HTTP/3 implementation. The analysis provides insights into the specific flaw found in the popular web server software. |
| 2026-06-19 2026 | Rapid7 Analysis: CVE-2020-12271: Sophos XG Firewall Pre-Auth SQL Injection Vulnerability intermediate 1 min read | Analysis of CVE-2020-12271 details a pre-authentication SQL injection vulnerability affecting Sophos XG Firewalls, which can lead to remote code execution. Exploited in the wild, this zero-day flaw, with a CVSSv3 score of 10, allows attackers to download malware, establish persistence, and exfiltrate credentials. Affected versions include 17.0, 17.1, 17.5, and 18.0. The analysis highlights reverse engineering efforts and ongoing threats even after a patch is available. → rapid7.com |
| 2026-06-19 2026 | AutoJack Attack Lets One Web Page Hijack AI Agent for Host Code Execution news 3 min read | Writeup detailing the AutoJack attack, an exploit chain targeting AutoGen Studio's pre-release versions (0.4.3.dev1 and 0.4.3.dev2). This vulnerability allows a malicious webpage, loaded by an AI browsing agent, to execute arbitrary commands on the host machine. The attack exploits three weaknesses in the Model Context Protocol (MCP) WebSocket: localhost trust, skipped authentication middleware, and unauthenticated command execution. While a plain `pip install autogenstudio` is unaffected, users of pre-releases must pull fixes from GitHub main (commit b047730) as a patched PyPI release is not yet available. This research highlights broader risks in agent frameworks, echoing similar localhost vulnerabilities found in Semantic Kernel (CVE-2026-26030, CVE-2026-25592) and ChatGPhish. → thehackernews.com |
| 2026-06-18 2026 | F5 Patches Two Critical NGINX Open Source Flaws Enabling Remote Code Execution news 2 min read | Writeup of CVE-2026-42530 and CVE-2026-42055, two critical NGINX Open Source vulnerabilities patched by F5. CVE-2026-42530, a use-after-free flaw in the HTTP/3 QUIC module, allows remote code execution. CVE-2026-42055, a heap-based buffer overflow in proxy modules, also enables code execution. Both flaws have high CVSS scores and affected various NGINX products, including NGINX Plus and Ingress Controller. Mitigations involve disabling HTTP/3 or adjusting proxy configurations. → thehackernews.com |
| 2026-06-18 2026 | F5 Patches Critical NGINX Vulnerabilities Enabling Unauthenticated Code Execution news 2 min read | Patches address critical NGINX vulnerabilities CVE-2026-42530 and CVE-2026-42055, both with CVSS 9.2. CVE-2026-42530, a Use-After-Free in `ngx_http_v3_module`, enables remote unauthenticated attackers to cause restarts or arbitrary code execution via crafted HTTP/3 sessions. CVE-2026-42055, a heap-based buffer overflow in `ngx_http_proxy_v2_module` and `ngx_http_grpc_module`, requires specific configurations like disabled header validation for potential code execution. High-severity CVE-2026-11311 and CVE-2026-50107 in NGINX Gateway Fabric also allow authenticated configuration directive injection. → securityaffairs.com |
| 2026-06-18 2026 | Under the Radar: Exploring Spring Boot Actuator Misconfigurations intermediate 10 min read Secrets | Library for detecting Spring Boot Actuator misconfigurations that can leak sensitive data like environment variables, passwords, and API keys, or even lead to remote code execution. The library highlights common vulnerabilities such as exposed `/heapdump` files and insecure `/gateway/routes` endpoints, particularly noting CVE-2022-22947 in Spring Cloud Gateway versions and default exposures prior to Spring Boot Actuator 1.5. → wiz.io |
| 2026-06-18 2026 | A Crash, Not a Shell: SolarWinds Serv-U CVE-2026-28318 advanced 5 min read | Tool for detecting SolarWinds Serv-U CVE-2026-28318, a denial-of-service vulnerability affecting versions prior to 15.5.4 HF1. The vulnerability allows an unauthenticated POST request with `Content-Encoding: deflate` to crash the service by triggering heap corruption. While heap corruption can sometimes lead to remote code execution, this analysis demonstrates that three distinct RCE exploitation paths are dead ends, confirming the vulnerability's impact is availability-only. The tool flags vulnerable hosts without triggering the crash, and mitigation involves patching or WAF filtering of POST requests with `Content-Encoding` headers. → bishopfox.com |