The newest Remote Code Execution (RCE) resources are on the Remote Code Execution (RCE) page. For a reading order instead of a date order, see the Remote Code Execution (RCE) learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-06-09 2026 | Critical Veeam RCE flaw Lets Low-Privilege Users Take Over Backup Servers news 1 min read | Writeup of CVE-2026-44963, a critical RCE vulnerability in Veeam Backup & Replication 12.x, allowing low-privileged domain users to compromise backup servers. This flaw, with a CVSS v4 score of 9.4, could enable attackers to delete or encrypt backups, steal data, and extract credentials for further network compromise. A previous critical vulnerability, CVE-2025-23121, was patched in June 2025. → securityaffairs.com |
| 2026-06-09 2026 | Veeam Backup & Replication RCE Flaw Lets Domain Users Run Remote Code news | Writeup of CVE-2026-44963, a critical remote code execution flaw in Veeam Backup & Replication impacting version 12.3.2.4465 and earlier. This vulnerability, with a CVSS score of 9.4, allows authenticated domain users to execute code on the Backup Server. Veeam has released patches, addressing the issue in version 12.3.2.4854, and noting that version 13.x builds are not affected due to architectural changes. → thehackernews.com |
| 2026-06-09 2026 | New Veeam vulnerability exposes backup servers to RCE attacks news 2 min read | Writeup detailing CVE-2026-44963, a critical remote code execution flaw in Veeam Backup & Replication (VBR) versions 12.3.2.4465 and earlier, which allows authenticated domain users to compromise backup servers. This vulnerability impacts domain-joined installations, a configuration that deviates from Veeam's best practices. The article highlights the history of VBR flaws being exploited by ransomware gangs like Akira, Fog, Frag, FIN7, and Cuba, and notes that reverse-engineering of patches is likely to occur. Veeam has released patches in version 12.3.2.4854. → bleepingcomputer.com |
| 2026-06-09 2026 | Vulnerabilities in Logseq software news 1 min read | Writeup on CVE-2026-9279 and related vulnerabilities in Logseq software. This analysis details how an IPC handler bypass via shell metacharacters in arguments to `child_process.spawn` allows arbitrary shell command execution. Additional vulnerabilities include improper path validation in preload scripts leading to file manipulation, stored XSS in `package.json`'s name field, and a sandbox escape flaw enabled by a disabled CSP, allowing arbitrary JavaScript execution in the host context. Version v0.10.15 was confirmed vulnerable. → cert.pl |
| 2026-06-09 2026 | Active Exploitation Alert: CVE-2026-42271 and CVE-2026-48710Unauthenticated RCE in LiteLLM AI Gateway via Starlette Host Header Bypass news 5 min read | Writeup details active exploitation of CVE-2026-42271, an unauthenticated RCE in LiteLLM AI Gateway, by chaining it with a Starlette Host header bypass (CVE-2026-48710). This chain enables attackers to execute arbitrary commands on vulnerable systems, leading to full compromise. Exploitation is widespread, with the vulnerabilities listed on CISA's KEV catalog. The article explains the technical exploitation flow and suggests upgrading LiteLLM to version 1.83.7 and Starlette to 1.0.1 as mitigation. → rescana.com |
| 2026-06-09 2026 | Claude Mythos: Preparing for a World Where AI Finds and Exploits Vulnerabilities Faster Than Ever advanced 10 min read AI | Analysis of Anthropic's Claude Mythos, an AI model capable of autonomously discovering zero-day vulnerabilities and generating exploits. This capability signals a future where AI-driven vulnerability research accelerates, leading to more CVEs in the short term and necessitating an AI-focused AppSec program for defense in the medium-to-long term. The trend suggests attackers will leverage AI, requiring defenders to adapt by integrating AI into security tooling and workflows to proactively identify and remediate flaws. → wiz.io |
| 2026-06-09 2026 | Securing AI Applications From Inception to Deployment intermediate 5 min read AI | Library extending Wiz AI-APP to the code layer, Wiz Code integrates with IDEs and the CLI to detect AI-specific risks during development. It validates exploitability at runtime using an AI attacker, Red Agent, then automates remediation with Green Agent, generating context-aware fixes and delegating tasks to coding agents. This unified approach aligns with OWASP Top 10 for LLM Applications 2025 and Agentic Applications 2026, securing the entire AI application lifecycle from inception to production. → wiz.io |
| 2026-06-09 2026 | Securing GitHub: Wiz Research uncovers Remote Code Execution in GitHub.com and GitHub Enterprise Server (CVE-2026-3854) news 10 min read | Writeup of CVE-2026-3854, an RCE vulnerability in GitHub's git infrastructure, identified by Wiz Research. The flaw in the X-Stat header parsing allowed authenticated users to execute arbitrary commands on backend servers via a crafted git push. Exploitation leverages injection of fields like `rails_env`, `custom_hooks_dir`, and `repo_pre_receive_hooks` to bypass sandboxing and achieve command execution. This impacts both GitHub.com and GitHub Enterprise Server, with immediate patching recommended for GHES customers. → wiz.io |
| 2026-06-09 2026 | How a Poisoned Security Scanner Became the Key to Backdooring LiteLLM news 9 min read Python Supply Chain | Library detailing the compromise of the `litellm` Python package via a poisoned Trivy security scanner. The attack chain, attributed to threat actor TeamPCP, involved rewriting Git tags in Trivy's GitHub Action, leading to credential exfiltration used to publish malicious `litellm` versions. These versions utilized source injection and a `.pth` file for payload delivery, a technique mapped to MITRE ATT\&CK T1546.018. The payload performed extensive data collection, encrypted and exfiltrated information, and established local persistence and Kubernetes lateral movement. → snyk.io |
| 2026-06-09 2026 | Axios npm Package Compromised: Supply Chain Attack Delivers Cross-Platform RAT news 7 min read Supply Chain | Library that details a supply chain attack on the popular npm package `axios`. Malicious versions, `1.14.1` and `0.30.4`, were briefly published, including a hidden dependency `plain-crypto-js` which deployed a cross-platform RAT. The attack leveraged a compromised maintainer account and a purpose-built malicious dependency with a postinstall script that obfuscated its presence and delivered platform-specific payloads for macOS, Windows, and Linux. → snyk.io |
| 2026-06-08 2026 | JavaScript Prototype Pollution Deep Dive : — Reconnaissance, Exploitation & Bug Bounty Guideline intermediate XSS | This guide offers a deep dive into JavaScript Prototype Pollution, a misunderstood vulnerability. It covers reconnaissance, exploitation from cross-site scripting (XSS) to remote code execution (RCE), and real-world bug bounty case studies. The content explores attack vectors, entry points, advanced exploit chains, and includes tooling/automation for detection, along with defense and remediation strategies. A production-ready Python scanner is also mentioned. The article aims to demystify this vulnerability for security professionals and bug bounty hunters. → infosecwriteups.com |
| 2026-06-08 2026 | Node-gyp Supply Chain Compromise: A Self-Propagating npm Worm That Hides in binding.gyp intermediate 10 min read Supply Chain | Library for detecting and mitigating the Node-gyp Supply Chain Compromise, a self-propagating npm worm that exploits `binding.gyp` files for code execution. This malware, tracked as "Miasma" by StepSecurity and "Node-gyp Supply Chain Compromise - June 2026" by Snyk, injects malicious code during `npm install` by abusing `node-gyp`'s configuration phase. The payload harvests credentials from developer and CI/CD environments, including AWS, GCP, Azure, and GitHub Actions, then exfiltrates them via attacker-controlled GitHub repositories and maintains persistence through GitHub Actions workflows. It self-propagates by republishing affected packages, impacting 57 packages across hundreds of malicious versions. → snyk.io |
| 2026-06-08 2026 | From XSS to RCE (dompdf 0day) intermediate 10 min read XSS | Library for rendering PDFs from HTML that suffers from Remote Code Execution. By injecting CSS with a malicious font and enabling remote file access, an attacker can trick dompdf into caching a `.php` file in its font cache. This cached file can then be executed by accessing it directly, leading to RCE. |
| 2026-06-08 2026 | Hacking Auto-GPT and escaping its docker container intermediate 17 min read AI | Library detailing an attack on Auto-GPT that exploits indirect prompt injection to achieve arbitrary code execution. The exploit involves tricking Auto-GPT into processing attacker-controlled website content via the `browse_website` command, leading to unauthorized command execution. The library also covers a trivial Docker escape vulnerability, allowing access to the host system, and a path traversal exploit in non-Docker versions, both fixed in v0.4.3. |
| 2026-06-08 2026 | Intigriti Bug Bytes #236 - May 2026 🚀 news 7 min read Bug Bounty | Library for Burp Suite, Intigriti Quick Scope (IQS), fetches programs from the Researcher API to auto-configure project scope and headers, simplifying workflow for researchers. This issue also highlights exploits for SQL injection, bypasses for Chrome's Sanitizer API, and RCE in Google Cloud, alongside discussions on AI in security, NIS2 compliance, and practical red teaming techniques. → intigriti.com |
| 2026-06-08 2026 | Looting UniFi Controllers: Detecting and Weaponizing CVE-2026-22557 intermediate 20 min read AuthZ | Tool for detecting and weaponizing CVE-2026-22557, an unauthenticated path traversal vulnerability in UniFi Network Application's guest captive portal. This critical flaw, with a CVSS score of 10.0, allows attackers to read arbitrary files from customized portals, potentially exfiltrating backups containing administrative credentials for all managed devices. The accompanying tool from Bishop Fox safely identifies vulnerable controllers, while this analysis details attack paths, exploitability preconditions, and mitigation strategies, including patching to updated versions like 10.1.89 or later. → bishopfox.com |
| 2026-06-08 2026 | Popping Root on UniFi OS Server: Unauthenticated RCE Chain Detection & Analysis advanced 18 min read AuthZ | Tool for detecting unauthenticated RCE chains on UniFi OS Server, specifically addressing CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910. This vulnerability allows attackers to bypass authentication, perform path traversal, and achieve command injection leading to root privileges. The tool aids defenders in identifying exposed systems and recommends immediate patching, network segmentation, and secret rotation, as exploitation grants access to sensitive data and control over managed devices. → bishopfox.com |
| 2026-06-08 2026 | Breaking the Sound Barrier, Part II: Exploiting CVE-2024-54529 advanced 13 min read Fuzzing | Writeup detailing the exploitation of CVE-2024-54529, a type confusion vulnerability in macOS's CoreAudio daemon. The author describes the process of turning the crash into a working exploit by establishing a pointer chain to control object types and ultimately hijack control flow. This involved developing custom tools like an object dumper using TinyInst and performing static analysis with IDAPython to navigate heap intricacies and overcome initial exploitation hurdles with CFString objects. The analysis also explored and ruled out an out-of-bounds read primitive, highlighting the importance of version-specific vulnerabilities. → projectzero.google |
| 2026-06-08 2026 | A 0-click exploit chain for the Pixel 10: When a Door Closes, a Window Opens advanced 5 min read Mobile | Writeup detailing a two-exploit chain achieving root on the Google Pixel 10, bypassing Pixel 9 privilege escalation with a novel VPU driver vulnerability (CVE-2026-0000). The Dolby UDC exploit, patched in December 2025, was adapted for Pixel 10 by addressing RET PAC, and a new vulnerability in the /dev/vpu driver allowed arbitrary kernel read-write via an unbounded `mmap` handler, patched in the February 2026 security bulletin. → projectzero.google |
| 2026-06-07 2026 | Mirasvit Vulnerability Exploited to Execute Code on Magento Servers news 2 min read | Writeup of CVE-2026-45247, a critical PHP object injection vulnerability in Mirasvit's Full Page Cache Warmer for Magento 2, allowing unauthenticated remote code execution. Exploitation occurs via crafted serialized PHP objects in the CacheWarmer cookie, leading to arbitrary code execution on Magento and Adobe Commerce servers. Organizations using versions prior to 1.11.12 are vulnerable, and detection indicators include CacheWarmer cookie values starting with specific base64 strings. → securityweek.com |
| 2026-06-05 2026 | VS Code Vulnerability Allows One-Click GitHub Token Theft news 2 min read | Writeup details a VS Code vulnerability allowing one-click GitHub token theft via specially crafted Jupyter notebooks on github.dev. Exploiting this zero-day involves hidden code simulating keystrokes to install a malicious extension, which then exfiltrates the user's GitHub access token. This grants attackers read/write access to repositories, including private ones. The vulnerability also affects the desktop version of VS Code, potentially leading to remote code execution, though it appears unpatched there. → securityweek.com |
| 2026-06-03 2026 | Exclusive: How One Line of Code Put Billions of Microsoft Android App Downloads at Risk news 3 min read | Library detailing a critical vulnerability in six Microsoft Android apps, including Word and Excel, where a single debug flag, `setIsDebugMode(true)`, left in production code allowed untrusted apps to intercept Microsoft account access tokens. This flaw, affecting billions of downloads and assigned CVE-2026-41100, -41101, and -41102, enabled potential supply chain attacks by granting attackers access to sensitive data like emails and documents. The issue was identified by Enclave and has since been patched by Microsoft. → securityweek.com |
| 2026-06-03 2026 | CVE-2026-34197 Jolokia Exposure Enables RCE in Apache ActiveMQ news 10 min read | Writeup of CVE-2026-34197, a remote code execution vulnerability in Apache ActiveMQ Classic, stemming from insecure exposure of broker management via the Jolokia HTTP/JMX interface. This allows attackers to interact with privileged operations, potentially leading to broker-side processing of malicious configuration content. Validation confirmed exploit path feasibility in controlled, insecure environments, highlighting a significant enterprise security concern due to ActiveMQ's critical infrastructure role. |
| 2026-06-03 2026 | Critical Vulnerability in HP VoIP Phones Enables Enterprise Network Breaches news 2 min read | Writeup of CVE-2026-0826, a critical stack-based buffer overflow in HP Poly Voice VoIP phones impacting models like the VVX 150-450 and Trio 8800-8300 series. The vulnerability, exploitable via crafted SIP INVITE requests with malicious Session Description Protocol attributes when Interactive Connectivity Establishment (ICE) is enabled, allows for remote code execution with root privileges by leveraging Return Oriented Programming chains to bypass ASLR and NX mitigations. Disabling ICE or updating firmware mitigates the risk. → securityweek.com |
| 2026-06-02 2026 | HP Poly VoIP vulnerability sets the stage for executive voice deepfakes news 3 min read | Writeup of CVE-2026-0826, a critical buffer overflow vulnerability in HP Poly VoIP phones, allows unauthenticated attackers to gain root access and perform eavesdropping or record audio for AI-enabled voice deepfakes. Discovered by Rapid7, the flaw in the SDP parsing code, even with ASLR enabled, enables exploit execution via Metasploit. This vulnerability highlights the growing threat of embedded device compromise for both traditional espionage and modern AI-driven fraud. → csoonline.com |
| 2026-06-02 2026 | Critical Windows Netlogon Vulnerability in Attackers Crosshairs news 2 min read | Writeup of CVE-2026-41089, a critical Windows Netlogon vulnerability, details its exploitation for remote code execution by threat actors. This stack-based buffer overflow flaw allows unauthenticated attackers to target domain controllers, potentially gaining system privileges. The Centre for Cybersecurity Belgium warns of active in-the-wild exploitation, urging immediate patching despite Microsoft's initial assessment. This vulnerability poses a significant risk due to Netlogon's role in domain authentication. → securityweek.com |
| 2026-05-30 2026 | Notepad vulnerabilities could enable arbitrary code execution on Windows systems news 3 min read | Library of information detailing two arbitrary code execution vulnerabilities, CVE-2026-48778 and CVE-2026-48800, affecting Notepad++ versions up to 8.9.6. These flaws, rated High (CVSS 7.8), allow local attackers to execute commands by manipulating `shortcuts.xml` and `config.xml` files. A third crash bug, CVE-2026-48770, was also patched. Exploitation requires the attacker to have write access to user profile directories or trick the user into opening a poisoned settings folder. → csoonline.com |
| 2026-05-29 2026 | No fix yet for critical Gogs RCE bug - exploit module is out news 3 min read | Writeup on a critical Remote Code Execution (RCE) vulnerability in the open-source Git service Gogs. As of May 2024, no fix has been released, and an exploit module is publicly available. The researcher reported the vulnerability in March, but maintainers have not responded. → theregister.com |
| 2026-05-29 2026 | Attackers Use LLM Agent for Post-Exploitation After Marimo CVE-2026-39987 Exploit intermediate 3 min read | Writeup on CVE-2026-39987 exploitation impacting Marimo, detailing how attackers leverage an LLM agent for post-exploitation. The agent autonomously exfiltrated cloud credentials and an SSH private key from AWS Secrets Manager, subsequently used to access an SSH bastion server and extract an internal PostgreSQL database schema and contents rapidly. Indicators of LLM involvement include improvisational database dumping, machine-consumable command streams with delimiters, and the agent feeding its own previous output into subsequent actions. → thehackernews.com |
| 2026-05-28 2026 | New Gogs zero-day flaw lets hackers get remote code execution news 3 min read | Library for analyzing Gogs zero-day RCE vulnerabilities, including an unpatched argument injection flaw enabling remote code execution via specially crafted pull requests and malicious branch names. This critical vulnerability, affecting Gogs 0.14.2 and 0.15.0+dev, allows authenticated attackers to compromise servers, access private repositories, and extract credentials. The flaw resembles previously patched argument injection issues like CVE-2024-39933 and CVE-2024-39932, but targets a different code path. → bleepingcomputer.com |
| 2026-05-27 2026 | SharePoint Has a New RCE Flaw. If You Haven't Patched Yet Go Do That. news 1 min read | Writeup of CVE-2026-45659, a high-severity Microsoft SharePoint remote code execution vulnerability. Exploitable by authenticated attackers with minimal Site Member permissions, the flaw stems from deserialization of untrusted data and does not require complex conditions. Microsoft has released patches for SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. This follows other recent SharePoint targeting, including CVE-2026-32201 being added to CISA's KEV catalog. → securityaffairs.com |
| 2026-05-26 2026 | High-severity SharePoint RCE bug patched by Microsoft (CVE-2026-45659) news 1 min read | Writeup of CVE-2026-45659, a high-severity SharePoint RCE vulnerability patched by Microsoft. This flaw allows authenticated attackers to execute arbitrary code remotely on vulnerable SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016 instances through deserialization of untrusted data, requiring low attack complexity without user interaction. → helpnetsecurity.com |
| 2026-05-26 2026 | Active Exploitation of CVE-2026-5426 in KnowledgeDeliver LMS Enables Godzilla (BLUEBEAM) Web Shell and Cobalt Strike Attacks news 5 min read | Analysis of CVE-2026-5426 in KnowledgeDeliver LMS reveals exploitation of hardcoded ASP.NET machineKey values, enabling unauthenticated remote code execution. Threat actors deploy the Godzilla (BLUEBEAM) web shell and Cobalt Strike BEACON payloads, targeting Japanese enterprises and educational institutions. Attackers leverage ViewState deserialization for initial access, install web shells for persistence, and employ social engineering to deliver Cobalt Strike to user endpoints, leading to widespread compromise. → rescana.com |
| 2026-05-25 2026 | From Auth Bypass to RCE: A 4-Vulnerability Exploit Chain in DataEase advanced 6 min read | Writeup of a 4-vulnerability exploit chain in DataEase, including CVE-2026-40899, CVE-2026-40900, and CVE-2026-40901, alongside a previously disclosed authentication bypass. This chain enables unauthenticated remote command execution and data exposure by leveraging a JDBC blocklist bypass for arbitrary file read, stacked SQL injection for database manipulation, and Quartz deserialization for RCE. The exploit targets DataEase versions up to v2.10.21, and users should upgrade to v2.10.21 or later. → ox.security |
| 2026-05-24 2026 | Drupal Remote Code Execution vulnerability news 1 min read | Vulnerability describing a Drupal Remote Code Execution flaw impacting various versions of Drupal 8.9 and later, up to Drupal 11.3.10, allows attackers to execute code, manipulate data, elevate privileges, and disclose sensitive information. Patches are available for Drupal 8.9, Drupal 9.5, and updates are recommended for Drupal 10.4.x through 11.3.x. End-of-life versions like Drupal 8 and 9 may have other unaddressed vulnerabilities. → hkcert.org |
| 2026-05-22 2026 | Attackers Can Exploit a Claude Code RCE Flaw to Take Command of System news 3 min read | Library for securing developer models, this entry details a critical RCE vulnerability in Anthropic's Claude Code (version 2.1.118). Attackers could exploit a parsing flaw in the `eagerParseCliFlag` function via crafted deeplinks to inject arbitrary commands, bypassing trust prompts and taking control of a victim's system. The vulnerability was discovered by Joernchen of 0day.click and has since been patched. → devops.com |
| 2026-05-21 2026 | Experts warn of active exploitation of critical NGINX flaw CVE-2026-42945 news 2 min read | Writeup of CVE-2026-42945, also known as NGINX Rift, detailing a critical heap buffer overflow in NGINX Plus and Open Source impacting the `ngx_http_rewrite_module`. This vulnerability arises from how rewrite directives with unnamed PCRE capture groups and specific replacement string patterns interact with the script engine, potentially leading to a controlled buffer overflow. While actively exploited, remote code execution requires specific NGINX configurations and the disabling of ASLR on modern Linux systems, making widespread RCE attacks less likely according to expert analysis. → securityaffairs.com |
| 2026-05-21 2026 | Highly Critical Drupal Core Flaw Exposes PostgreSQL Sites to RCE Attacks news 2 min read | Analysis of CVE-2026-9082, a critical Drupal Core vulnerability affecting PostgreSQL sites, enables remote code execution and privilege escalation. Exploitable by anonymous users, this flaw stems from a database abstraction API weakness. Searchlight Cyber has released proof-of-concept code, highlighting the urgency for sites using PostgreSQL to update to patched Drupal versions, including 11.3.10, 10.6.9, and others, which also contain upstream Symfony and Twig security updates. → thehackernews.com |
| 2026-05-20 2026 | Critical RCE SQL Injection and Privilege Escalation Vulnerabilities Affecting Ivanti Endpoint Manager Fortinet FortiClient EMS (CVE-2026-21643) SAP VMware and n8n: CVE Analysis Exploitation and Patch Guidance news 5 min read | Analysis of critical RCE, SQL Injection, and Privilege Escalation vulnerabilities affecting Ivanti Endpoint Manager (CVE-2025-11622, CVE-2025-9713), Fortinet FortiClient EMS (CVE-2026-21643), SAP, VMware, and n8n. This advisory details exploitation vectors, including insecure deserialization and path traversal on Ivanti, and improper Site header handling on Fortinet, which can lead to unauthenticated RCE. The analysis covers affected versions, active exploitation trends, and mitigation strategies such as immediate patching and monitoring for suspicious activity across these enterprise platforms. → rescana.com |
| 2026-05-20 2026 | Mozilla Products Multiple Vulnerabilities news 1 min read | Bulletin detailing multiple vulnerabilities affecting Mozilla Products including Firefox, Firefox ESR, Firefox for iOS, and Thunderbird. Exploitable by remote attackers, these issues can lead to denial of service, remote code execution, information disclosure, security restriction bypass, elevation of privilege, and spoofing. Specific CVEs such as CVE-2026-8388, CVE-2026-8391, and CVE-2026-8401 are listed, with patches available for affected versions including Firefox 151 and Thunderbird 151. → hkcert.org |
| 2026-05-19 2026 | TP-Link Photoshop OpenVPN Norton VPN vulnerabilities news 3 min read | Writeup detailing eight vulnerabilities in TP-Link Archer AX53 routers, including stack-based buffer overflow (CVE-2026-30814) and OS command injection (CVE-2026-30815, CVE-2026-30816, CVE-2026-30817, CVE-2026-30818, TALOS-2025-2307, TALOS-2025-2308, TALOS-2025-2309). It also covers privilege escalation in Adobe Photoshop via the Microsoft Store (CVE-2026-34632), a reachable assertion leading to DoS in OpenVPN (CVE-2026-35058), and privilege escalation in Norton VPN via the Microsoft Store (CVE-2025-58074). → blog.talosintelligence.com |
| 2026-05-19 2026 | Unpatched ChromaDB Vulnerability Can Lead to Server Takeover news 2 min read | Writeup of CVE-2026-45829, dubbed ChromaToast, a pre-authentication RCE vulnerability in ChromaDB. This flaw allows unauthenticated attackers to execute arbitrary code, gain shell access, and compromise sensitive data, including API keys and secrets. Exploitation involves tricking the server into downloading and executing a malicious HuggingFace model before authentication. The vulnerability affects ChromaDB versions since 1.0.0, with an estimated 73% of internet-accessible deployments exposed. HiddenLayer and researcher Azraelxuemo have reported the issue without response from Chroma. → securityweek.com |
| 2026-05-19 2026 | PoC Code Published for Critical NGINX Vulnerability news 2 min read | Writeup detailing CVE-2026-42945, a critical heap buffer overflow in NGINX's `ngx_http_rewrite_module` that can lead to denial-of-service or remote code execution. The vulnerability arises from a two-pass script engine process where an undersized buffer is allocated due to an unpropagated flag when a rewrite replacement contains a question mark. Exploitation involves manipulating request URIs with escapable characters to control the overflow size and employing cross-request heap feng shui to corrupt cleanup pointers for RCE. Patched versions include NGINX Plus 37.0.0 and NGINX open source 1.31.0. → securityweek.com |
| 2026-05-19 2026 | SEPPMail Secure E-Mail Gateway Vulnerabilities Enable RCE and Mail Traffic Access news 2 min read | Writeup of SEPPMail Secure E-Mail Gateway vulnerabilities including CVE-2026-2743 for path traversal leading to RCE, CVE-2026-7864 for information exposure, CVE-2026-44125 for missing authorization, CVE-2026-44126 for deserialization, CVE-2026-44127 for path traversal and file deletion, CVE-2026-44128 for eval injection, and CVE-2026-44129 for template engine vulnerabilities. These flaws allow unauthenticated attackers to execute arbitrary code, read mail traffic, and gain network access, with some fixed in versions 15.0.2.1, 15.0.3, and 15.0.4. → thehackernews.com |
| 2026-05-17 2026 | NGINX CVE-2026-42945 Exploited in the Wild Causing Worker Crashes and Possible RCE news 2 min read | Library updates address critical NGINX CVE-2026-42945, a heap buffer overflow in ngx_http_rewrite_module causing worker crashes and potential RCE when ASLR is disabled. Also, two openDCIM vulnerabilities, CVE-2026-28515 (missing authorization) and CVE-2026-28517 (OS command injection), are actively exploited and can be chained with CVE-2026-28516 (SQL injection) for RCE, reportedly by attackers using AI tools like Vulnhuntr. → thehackernews.com |
| 2026-05-17 2026 | CVE-2026-42945: NGINX Rewrite Heap Overflow Enables Remote DoS & Potential RCE news 5 min read | Writeup of CVE-2026-42945, an NGINX rewrite heap overflow vulnerability, details its exploitation via crafted HTTP requests, particularly when using unnamed PCRE captures with a question mark in the replacement string. This flaw, present in versions from 0.6.27 through 1.30.0, can lead to Denial of Service through worker crashes or potential Remote Code Execution, especially with ASLR disabled. A proof-of-concept demonstrating RCE has been published. → socradar.io |
| 2026-05-16 2026 | Microsofts Patch Tuesday Update Targets 120 Security Flaws news | Microsoft's latest Patch Tuesday update addresses 120 security vulnerabilities, a significant release aimed at bolstering system security. This update is critical for users to install to protect their systems from potential exploits. The specific details of each vulnerability and the affected products are available in Microsoft's official release notes. → techrepublic.com |
| 2026-05-15 2026 | Google Chrome Multiple Vulnerabilities news 1 min read | Writeup detailing multiple vulnerabilities in Google Chrome, affecting versions prior to 148.0.7778.167 (Linux) and 148.0.7778.167/168 (Mac/Windows). Exploitation of these CVEs, including CVE-2026-8509 through CVE-2026-8587, could lead to remote code execution, denial of service, security restriction bypass, spoofing, cross-site scripting, and information disclosure. Users are advised to update to the patched versions. → hkcert.org |
| 2026-05-14 2026 | AI agent finds 18-year-old remote code execution flaw in Nginx news 3 min read | Tool for finding vulnerabilities, this LLM-powered system discovered four bugs in Nginx, including CVE-2026-42945, a critical heap buffer overflow in the `ngx_http_rewrite_module` that allows for remote code execution by exploiting specific rewrite directive configurations. This flaw, impacting Nginx versions 0.6.27 to 1.30.0 and Nginx Plus, was patched in later releases. Additional vulnerabilities CVE-2026-42946, CVE-2026-42934, and CVE-2026-40701 were also identified, leading to denial of service, memory leaks, or data modification. → csoonline.com |
| 2026-05-14 2026 | ThreatsDay Bulletin: PAN-OS RCE Mythos cURL Bug AI Tokenizer Attacks and 10 Stories news 9 min read | Library for threat intelligence, detailing exploited PAN-OS RCE (CVE-2026-0300) with EarthWorm and ReverseSocks5 payloads, private AI chats leveraging Trusted Execution Environments for Meta AI, a zero-auth data leak impacting Schemata's AI training platform, the FCC's router update deadline extension, Operation GriefLure's APT phishing targeting Vietnam and Philippines with RATs, a multi-stage intrusion using weaponized PowerShell disguised as JPEGs for ConnectWise ScreenConnect, an aid-themed infostealer using LNK files and Python implants, GhostLock's PoC demonstrating denial of file access via SMB share locking, AI scan results for cURL identifying a low-severity bug, and an MoU between Indian agencies for fraud-risk intelligence sharing. → thehackernews.com |