The newest Remote Code Execution (RCE) resources are on the Remote Code Execution (RCE) page. For a reading order instead of a date order, see the Remote Code Execution (RCE) learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-04-21 2026 | Tenable Research Uncovers Remote Code Execution Vulnerability in Microsoft GitHub Repository Exposing CI/CD Pipeline to Unauthorized Code Execution news 2 min read | Writeup detailing a Remote Code Execution (RCE) vulnerability in a Microsoft GitHub repository affecting CI/CD pipelines. The flaw, a Python string injection within GitHub Actions workflows, allowed attackers to exfiltrate GITHUB_TOKEN secrets by creating a malicious GitHub issue, leading to potential unauthorized code execution and supply chain compromises. Recommendations include implementing strict security controls, reviewing token permissions, and monitoring automated workflows. |
| 2026-04-20 2026 | Google Chrome Multiple Vulnerabilities news 1 min read | Writeup detailing multiple vulnerabilities in Google Chrome, including CVE-2026-6296 through CVE-2026-6364. Exploitation of these weaknesses can lead to remote code execution, denial of service, information disclosure, and security restriction bypass. Affected versions are prior to 147.0.7727.101 on Linux, and prior to 147.0.7727.101/102 on Mac and Windows. Mitigation involves updating to the latest vendor-released versions. → hkcert.org |
| 2026-04-20 2026 | SGLang CVE-2026-5760 (CVSS 9.8) Enables RCE via Malicious GGUF Model Files news 2 min read Python | Vulnerability CVE-2026-5760, a critical RCE flaw in SGLang with a CVSS score of 9.8, stems from Jinja2 server-side template injection in GGUF model files loaded via the "/v1/rerank" endpoint. Attackers craft malicious GGUF files with SSTI payloads in the tokenizer.chat_template parameter, leading to arbitrary Python code execution on the SGLang server when the endpoint is accessed. This vulnerability is similar to CVE-2024-34359 and CVE-2025-61620, and mitigation involves using ImmutableSandboxedEnvironment for template rendering. → thehackernews.com |
| 2026-04-20 2026 | Vulnerability exploitation surges often precede disclosure offering possible early warnings news | Vulnerability exploitation surges often precede disclosure, offering possible early warnings https://ift.tt/UAnQyhJ → cybersecuritydive.com |
| 2026-04-19 2026 | CISA tells feds to patch 13-year-old Apache ActiveMQ bug under active attack news 2 min read | Reference for CVE-2026-34197, a critical remote code execution vulnerability in Apache ActiveMQ Classic. This 13-year-old flaw, now on CISA's Known Exploited Vulnerabilities catalog, allows authenticated attackers to run arbitrary OS commands via the Jolokia management API. The vulnerability is exacerbated by common default credentials and can be chained with CVE-2024-32114 on certain versions to enable unauthenticated exploitation. Patches are available in ActiveMQ versions 5.19.5 and 6.2.3. → theregister.com |
| 2026-04-19 2026 | CVE-2025-22457: Ivanti Connect Secure VPN Zero-Day RCE news | Writeup of CVE-2025-22457, a zero-day stack-based buffer overflow in Ivanti Connect Secure VPN exploited by UNC5221. This vulnerability allows unauthenticated remote code execution and has been used for data exfiltration and backdoor installation. Urgent patching to the latest fixed version is recommended to mitigate exploitation. → arcticwolf.com |
| 2026-04-19 2026 | Advisory: Actively Exploited Unauthenticated RCE in Ivanti Connect Secure (CVE-2025-0282) news 2 min read | Advisory for CVE-2025-0282, an unauthenticated RCE vulnerability in Ivanti Connect Secure and other Ivanti products, disclosed January 8, 2025, and actively exploited since mid-December 2024. This stack overflow allows arbitrary code execution. Exploitation tactics include lateral movement and SPAWN malware deployment, with links to previous Ivanti vulnerability campaigns. Ivanti's Integrity Checker Tool and Mandiant IoCs can identify compromise. |
| 2026-04-19 2026 | Command Injection in Jenkins via Git Parameter (CVE-2025-53652) intermediate 4 min read | Writeup of CVE-2025-53652 in Jenkins, detailing command injection via the Git Parameter plugin. Attackers can exploit unvalidated Git parameters to achieve remote code execution, leveraging Git's GTFObin capabilities to execute arbitrary commands like `sleep` or establish reverse shells. The vulnerability requires a valid session cookie, build name, and Jenkins crumb for exploitation, even in unauthenticated instances. Detection is possible through Suricata rules and analysis of Jenkins job logs. → vulncheck.com |
| 2026-04-19 2026 | 0xMarcio/cve: Latest CVEs with PoC Exploits intermediate | Library of CVE data, offering JSON endpoints for direct access to exploit Proofs of Concept (PoCs), CVSS assessments, and exploitation likelihood scores via EPSS. It includes curated lists of actively exploited vulnerabilities by CISA, with integrations for tools like Nuclei, Metasploit, and Exploit-DB. Users can query specific CVEs such as CVE-2021-44228 and access metadata for PoC repositories. |
| 2026-04-19 2026 | Microsoft WSUS RCE (CVE-2025-59287) Actively Exploited news 6 min read | Analysis of CVE-2025-59287, a critical unauthenticated RCE in Microsoft WSUS, details its exploitation via unsafe deserialization through the GetCookie() or ReportingWebService endpoints. Observed attack chains involve PowerShell execution, network reconnaissance, and exfiltration to attacker-controlled webhooks. Affected systems include various Windows Server versions with the WSUS role enabled. Temporary mitigations include disabling the WSUS role or blocking ports 8530 and 8531. → unit42.paloaltonetworks.com |
| 2026-04-18 2026 | Critical flaw in Protobuf library enables JavaScript code execution news 2 min read | Library vulnerability GHSA-xq3m-2v4x-88gg, a critical RCE flaw in protobuf.js, arises from unsafe dynamic code generation. Attackers can inject arbitrary JavaScript code by supplying malicious schemas, leading to code execution on servers or developer machines. Endor Labs identified the issue, impacting versions 8.0.0/7.5.4 and lower, with patches available in 8.0.1 and 7.5.5. Mitigation involves upgrading, auditing dependencies, and treating schema loading as untrusted input. → bleepingcomputer.com |
| 2026-04-17 2026 | U.S. CISA adds a flaw in Apache ActiveMQ to its Known Exploited Vulnerabilities catalog news 1 min read | Writeup of CVE-2026-34197, a critical flaw in Apache ActiveMQ Classic impacting versions prior to 5.19.4 and 6.2.3. This vulnerability, caused by improper input validation and unsafe code execution, allows authenticated attackers to achieve remote code execution by exploiting the Jolokia JMX-HTTP bridge. The flaw leverages a crafted discovery URI to force the broker to load a malicious remote Spring XML configuration, enabling arbitrary code execution through bean factory methods like `Runtime.exec()`. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, mandating remediation for federal agencies. → securityaffairs.com |
| 2026-04-17 2026 | Microsoft and Adobe Patch Tuesday April 2026 Security Update Review news 9 min read | Analysis of April 2026 Patch Tuesday updates from Microsoft and Adobe reveals 163 vulnerabilities addressed by Microsoft, including eight critical-severity issues and two zero-days: an access-control flaw in Windows Defender and an input validation flaw in Microsoft Office SharePoint, both actively exploited. Adobe patched 56 vulnerabilities across various products, with 38 critical. Notable Microsoft issues include use-after-free flaws in Remote Desktop Client and Microsoft Office, and race conditions in Windows Active Directory and TCP/IP, enabling remote code execution or privilege escalation. → blog.qualys.com |
| 2026-04-17 2026 | Apache ActiveMQ CVE-2026-34197 Added to CISA KEV Amid Active Exploitation news 2 min read | Writeup detailing CVE-2026-34197, a critical Apache ActiveMQ Classic vulnerability allowing code injection via the Jolokia API. This flaw, actively exploited and added to CISA's KEV catalog, has been present for 13 years and is exacerbated by CVE-2024-32114 on certain versions, enabling unauthenticated RCE. Horizon3.ai and SAFE Security highlight its exploitation targeting exposed management endpoints, with Fortinet noting dozens of attempts. Upgrading to versions 5.19.4 or 6.2.3 is recommended. → thehackernews.com |
| 2026-04-16 2026 | Empirical Study on RCE in ML Model Hosting Ecosystems advanced 56 min read | Survey of Remote Code Execution risks in ML model hosting ecosystems, analyzing custom code execution on platforms like Hugging Face and ModelScope. The study employs static analysis tools Bandit, CodeQL, and Semgrep, alongside YARA for pattern detection, to identify vulnerabilities. It also examines platform security mechanisms and developer discussions to understand perceptions, revealing widespread unsafe defaults and developer confusion about executing remote code. → arxiv.org |
| 2026-04-16 2026 | Method Confusion in Go SSTIs Lead to File Read and RCE advanced 3 min read | Library for researching Go Server-Side Template Injection (SSTI) vulnerabilities, focusing on method confusion within the `html/template` module. This library demonstrates how to achieve arbitrary file reads and Remote Code Execution (RCE) by leveraging exported methods of rendered objects, such as the `Secret` method for command execution or the `File` method from the `echo` framework for local file disclosure. → onsecurity.io |
| 2026-04-16 2026 | SmarterTools SmarterMail Pre-Auth RCE (CVE-2025-52691) news 10 min read | Writeup of CVE-2025-52691, a pre-authentication remote code execution vulnerability in SmarterTools SmarterMail. This analysis details how an unauthenticated file upload endpoint, which accepts a JSON-deserializable `contextData` parameter, allows an attacker to control a `guid` property. The patched build 9413 introduces GUID validation, suggesting its exploitation was previously possible by manipulating this field during upload processing, as detailed by Mr Chua Meng Han from CSIT. → labs.watchtowr.com |
| 2026-04-16 2026 | Dissecting and Exploiting CVE-2025-62507: RCE in Redis intermediate 12 min read | Writeup of CVE-2025-62507, a stack buffer overflow in Redis's XACKDEL command, details how an attacker can trigger this vulnerability by providing an excessive number of stream IDs. This overflow allows for overwriting the return address on the stack, potentially leading to remote code execution, especially in unauthenticated Redis instances. The analysis demonstrates exploiting this flaw by crashing the server with carefully crafted commands, revealing the path to weaponized exploits. → jfrog.com |
| 2026-04-16 2026 | Domain-Level RCE in Veeam Backup & Replication (CVE-2025-23120) intermediate 12 min read | Writeup detailing CVE-2025-23120, a domain-level RCE in Veeam Backup & Replication. This vulnerability arises from a flawed blacklist-based deserialization mechanism, allowing domain users to achieve SYSTEM privileges on the Veeam server. The attack leverages the .NET Remoting Channel and a specific class, `Veeam.Backup.Model.CDbCryptoKeyInfo`, which ultimately leads to inner deserialization with a blacklist. This writeup follows previous research on CVE-2024-40711, also in Veeam, highlighting the persistent issues with blacklist-based security. → labs.watchtowr.com |
| 2026-04-16 2026 | Exploitation Walkthrough - Ivanti Connect Secure RCE (CVE-2025-0282) intermediate 12 min read | Walkthrough of CVE-2025-0282 in Ivanti Connect Secure, detailing a stack-based buffer overflow in the `ift_handle_1` function. Exploitation involves crafting a malicious `clientCapabilities` block exceeding 256 bytes to trigger an out-of-bounds write. While direct return address overwriting is complicated by a preceding `free()` call on `object_to_be_freed`, an alternative exploitation path leverages a virtual function call at offset 0x48 within `a1`. → labs.watchtowr.com |
| 2026-04-16 2026 | React2Shell Deep Dive: CVE-2025-55182 Exploit Mechanics advanced 10 min read | Library detailing CVE-2025-55182, dubbed "React2Shell," a critical RCE vulnerability in React Server Components. This library breaks down the exploit mechanics, including improper input deserialization and gadget chains, and analyzes in-the-wild attacks observed by Wiz. These attacks range from opportunistic cryptomining and credential harvesting to sophisticated cloud backdoors leveraging Node.js for fileless persistence and Sliver implants for long-term access. The vulnerability has broader implications beyond Next.js, affecting frameworks like Waku and Vite with RSC plugins. → wiz.io |
| 2026-04-16 2026 | Remote Code Execution in Ghost CMS (CVE-2026-29053) intermediate 8 min read | Writeup on CVE-2026-29053, a remote code execution vulnerability in Ghost CMS versions 0.7.2 through 6.19.0. The flaw arises from unsafe expression evaluation within the theming system, where specially crafted themes can exploit a dependency chain involving the `jsonpath` and `static-eval` libraries. Exploitation requires an administrator to upload and activate a malicious theme, leading to arbitrary JavaScript execution on the server during page rendering, potentially impacting supply-chain trust and admin-targeted deception. |
| 2026-04-16 2026 | Ni8mare: Unauthenticated Remote Code Execution in n8n (CVE-2026-21858) intermediate 22 min read | Writeup of CVE-2026-21858, an unauthenticated remote code execution vulnerability in n8n discovered due to a Content-Type confusion bug. Attackers can exploit this flaw by crafting a malicious request that manipulates the `req.body.files` object, allowing them to read arbitrary local files and achieve full takeover of n8n instances. This issue impacts over 100,000 servers globally and has a CVSS score of 10.0. Users should upgrade to n8n version 1.121.0 or later for remediation. |
| 2026-04-16 2026 | Hackers exploit Marimo flaw to deploy NKAbuse malware from Hugging Face news 2 min read | Writeup detailing the exploitation of Marimo CVE-2026-39987, which allows remote code execution and deployment of NKAbuse malware. Attackers leverage Hugging Face Spaces, posing as legitimate AI tools, to host dropper scripts and malware binaries. The payload, a variant of NKAbuse, functions as a remote access trojan with capabilities for shell command execution and data exfiltration, including credential theft from environment variables and Redis servers. Exploitation has increased in volume and tactics, with affected users urged to upgrade Marimo to version 0.23.0 or later, or block external access to the `/terminal/ws` endpoint. → bleepingcomputer.com |
| 2026-04-16 2026 | ThreatsDay Bulletin: 17-Year-Old Excel RCEDefender 0-DaySonicWall Brute-Force and 15 More Stories news 12 min read | Library of recent application security vulnerabilities, including a 17-year-old Microsoft Office Excel RCE (CVE-2009-0238), a new Microsoft Defender privilege escalation zero-day (RedSun) and DoS exploit (UnDefend), a targeted cryptocurrency wallet breach via AI social engineering against Zerion, and a fake Ledger app on the Apple App Store that stole $9.5 million. It also covers a new ransomware strain (JanaWare) targeting Turkey, the uncovering of stealthy C2 frameworks (ObsidianStrike, ArchangelC2), and updates to Raspberry Pi OS disabling passwordless sudo by default. → thehackernews.com |
| 2026-04-16 2026 | Splunk Enterprise Update Patches Code Execution Vulnerability news 1 min read | Update for Splunk Enterprise addresses CVE-2026-20204, a high-severity flaw allowing low-privileged users to achieve remote code execution via temporary file handling issues. It also patches medium-severity vulnerabilities in Splunk Enterprise and Cloud Platform related to username formatting and Data Model Acceleration control. Additionally, CVE-2026-20205 in MCP Server, a high-severity vulnerability allowing authenticated attackers to view clear-text user sessions and tokens, is fixed in MCP Server app version 1.0.3. Patches for third-party packages across various Splunk products are also included. → securityweek.com |
| 2026-04-16 2026 | Weekly Vulnerability Report: Azure AI Spring AI Fortinet Bugs news 3 min read | Report detailing 1,431 vulnerabilities this week, including 270+ with public PoCs and 3 on underground forums. Highlights include CVE-2026-32213 in Azure AI Foundry, CVE-2026-35022 in Claude Code CLI, CVE-2026-22738 in Spring AI, CVE-2026-4631 in Cockpit, and CVE-2026-35616 in Fortinet FortiClient EMS. Also covers ICS vulnerabilities from Siemens, Hitachi Energy, and Yokogawa. |
| 2026-04-16 2026 | Cisco Patches Four Critical Identity Services Webex Flaws Enabling Code Execution news 2 min read | Writeup detailing Cisco's patching of four critical vulnerabilities in Identity Services and Webex Services. CVE-2026-20184, a critical improper certificate validation flaw in Webex SSO, allows unauthenticated user impersonation. CVE-2026-20147, CVE-2026-20180, and CVE-2026-20186 are insufficient input validation flaws in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC), enabling authenticated remote code execution and arbitrary command execution with administrative or read-only credentials respectively. → thehackernews.com |
| 2026-04-15 2026 | Adobe Acrobat Reader vulnerability trapped PDFs and prepress workflow security news 1 min read | Writeup of CVE-2026-34621, a vulnerability in Adobe Acrobat Reader exploiting internal APIs like `util.readFileIntoStream` and `RSS.addFeed` to achieve remote code execution and sandbox bypass. This flaw allowed attackers to exfiltrate local files and gain elevated privileges on prepress workstations, posing a significant risk to production data and connected systems. The vulnerability remained unpatched for months, highlighting workflow security challenges in the graphic arts industry. |
| 2026-04-15 2026 | Microsoft fixes 167 security flaws in April second biggest Patch Tuesday ever news 3 min read | Analysis of Microsoft's April Patch Tuesday, the second-largest security update ever, reveals fixes for 167 vulnerabilities across Windows, Office, and cloud services. Eight critical flaws include actively exploited zero-days in SharePoint Server (CVE-2026-32201) and Office, with some Office RCE vulnerabilities (e.g., CVE-2026-33114) exploitable via preview panes. Other critical issues affect the TCP/IP stack (CVE-2026-33827), Internet Key Exchange (CVE-2026-33824), Remote Desktop Client (CVE-2026-32157), Active Directory (CVE-2026-33826), and .NET Framework DoS (CVE-2026-23666). Additionally, an Elevation of Privilege vulnerability in Defender (CVE-2026-33825) was known pre-patch. |
| 2026-04-15 2026 | Microsoft Patch Tuesday for April 2026 fixed actively exploited SharePoint zero-day news 1 min read | Writeup of Microsoft's April 2026 Patch Tuesday, which fixed 165 vulnerabilities, including an actively exploited SharePoint zero-day, CVE-2026-32201. This critical spoofing vulnerability, likely an XSS flaw, allowed attackers to view or modify sensitive information. Security experts urge rapid patching, noting the release's large size and potential impact on organizations with internet-facing SharePoint servers. → securityaffairs.com |
| 2026-04-15 2026 | April Patch Tuesday Fixes Critical Flaws Across SAP Adobe Microsoft Fortinet and More news 3 min read | Reference detailing critical vulnerabilities patched in April's Patch Tuesday, including an SQL injection in SAP Business Planning and Consolidation (CVE-2026-27681), a remotely exploitable code execution in Adobe Acrobat Reader (CVE-2026-34621), and path traversal flaws in FortiSandbox (CVE-2026-39813, CVE-2026-39808). It also mentions a spoofing vulnerability in Microsoft SharePoint Server (CVE-2026-32201) and numerous other patches from vendors like ABB, AWS, Apple, Cisco, and Linux distributions. → thehackernews.com |
| 2026-04-15 2026 | Critical nginx-ui Vulnerability CVE-2026-33032 Allows Unauthenticated Nginx Takeover news 3 min read | Writeup of CVE-2026-33032, an authentication bypass vulnerability in nginx-ui. This flaw, codenamed MCPwn, allows unauthenticated attackers to seize control of Nginx services by exploiting the /mcp_message endpoint, which bypasses authentication while only enforcing IP whitelisting. Attackers can gain session IDs by leveraging a separate vulnerability (CVE-2026-27944) to decrypt backups and extract sensitive data, including "node_secret" credentials. Exploitation can lead to restarting Nginx, modifying configuration files, and intercepting traffic. The vulnerability is patched in nginx-ui version 2.3.4. → thehackernews.com |
| 2026-04-15 2026 | Zero Day Initiative The April 2026 Security Update Review news 9 min read | Reference detailing April 2026 security updates from Adobe and Microsoft, covering 61 CVEs in Adobe products like Acrobat Reader and ColdFusion, and 163 CVEs in Microsoft products including Windows, Office, and Azure. Highlights actively exploited vulnerabilities such as CVE-2026-32201 (SharePoint Server Spoofing), CVE-2026-33825 (Microsoft Defender Elevation of Privilege), CVE-2026-33827 (Windows TCP/IP RCE), and CVE-2026-33824 (Windows IKE Service RCE). Also notes critical vulnerabilities in Office, .NET, SQL Server, and Hyper-V, alongside numerous Elevation of Privilege and sandbox escape bugs. |
| 2026-04-15 2026 | Microsoft April 2026 Patch Tuesday Fixes 167 Flaws 2 Zero-Days news 6 min read | Library of Microsoft's April 2026 Patch Tuesday fixes details 167 vulnerabilities, including an actively exploited SharePoint zero-day (CVE-2026-32201) and a Defender privilege escalation zero-day (CVE-2026-33825) found using the Diffract fuzzing tool. This release also addresses remote code execution bugs in Office, particularly those exploitable via document preview, and high-severity flaws in products like Remote Desktop Client. |
| 2026-04-15 2026 | Fortinet Patches Critical FortiSandbox Vulnerabilities news 1 min read | Library advisories detail critical vulnerabilities patched by Fortinet, including CVE-2026-39813 for FortiSandbox JRPC API authentication bypass and CVE-2026-39808 for FortiSandbox OS command injection, both exploitable via HTTP requests without authentication. Additionally, CVE-2026-22828, a high-severity buffer overflow in FortiAnalyzer Cloud, was patched, alongside SQL injection bugs in FortiDDoS-F and FortiClientEMS, and various medium- and low-severity issues across other Fortinet products. → securityweek.com |
| 2026-04-15 2026 | Microsoft Issues Patches for SharePoint Zero-Day and 168 Other Vulnerabilities news 4 min read | Library of Microsoft patches addressing 169 vulnerabilities, including zero-day CVE-2026-32201 impacting SharePoint Server, a privilege escalation flaw in Microsoft Defender (CVE-2026-33825) known as BlueHammer, and a critical remote code execution vulnerability in Windows Internet Key Exchange (CVE-2026-33824). The release also included CVEs impacting AMD, Node.js, Windows Secure Boot, and Git for Windows. → thehackernews.com |
| 2026-04-15 2026 | Adobe Acrobat Remote Code Execution Vulnerability news | Writeup detailing CVE-2026-34621, a high-risk Adobe Acrobat remote code execution vulnerability. Exploitation requires user interaction, typically by opening a malicious file, and leads to arbitrary code execution via Prototype Pollution. Affected versions include Acrobat DC, Acrobat Reader DC, and Acrobat 2024, with patches available for update. → hkcert.org |
| 2026-04-14 2026 | Microsoft Patch Tuesday for April 2026 - Snort Rule and Prominent Vulnerabilities news 4 min read | Snort rules detect exploitation attempts for Microsoft's April 2026 Patch Tuesday, which includes 165 vulnerabilities. Critical issues addressed by the rules include CVE-2026-23666 (.NET DoS), CVE-2026-33824 (Windows IKE RCE), CVE-2026-33826 (Active Directory RCE), and CVE-2026-33827 (Windows TCP/IP RCE). The update also covers several "more likely" to be exploited important vulnerabilities, such as CVE-2026-0390 (UEFI Secure Boot bypass) and CVE-2026-32201 (SharePoint spoofing). → blog.talosintelligence.com |
| 2026-04-14 2026 | Microsoft April 2026 Patch Tuesday Fixes 160 Vulnerabilities Including 2 Zero-Day Flaws news | Microsoft April 2026 Patch Tuesday Fixes 160+ Vulnerabilities, Including 2 Zero-Day Flaws https://ift.tt/YKfCdMi |
| 2026-04-14 2026 | Microsoft April 2026 Patch Tuesday fixes 167 flaws 2 zero-days news | Microsoft April 2026 Patch Tuesday fixes 167 flaws, 2 zero-days https://ift.tt/nLAl5mZ → bleepingcomputer.com |
| 2026-04-14 2026 | Adobe patched zero day in Acrobat that allowed remote code execution news 2 min read | Writeup detailing CVE-2026-34621, an Adobe Acrobat zero-day vulnerability patched by Adobe. This flaw allowed for remote code execution, enabling malware installation on Windows and macOS through maliciously crafted PDF files. The vulnerability, exploited in the wild for at least four months, could grant attackers full control over a victim's system and facilitate data theft across Acrobat DC, Reader DC, and Acrobat 2024. |
| 2026-04-14 2026 | ShowDoc RCE Flaw CVE-2025-0520 Actively Exploited on Unpatched Servers news 1 min read | Writeup of CVE-2025-0520, a critical ShowDoc RCE flaw with CVSS 9.4, actively exploited due to unrestricted file upload via improper extension validation. Attackers can upload PHP web shells to execute arbitrary code on unpatched servers running versions before 2.8.7, demonstrating the exploitation of N-day vulnerabilities. → thehackernews.com |
| 2026-04-14 2026 | CISA Adds 6 Known Exploited Flaws in Fortinet Microsoft and Adobe Software news 1 min read | Survey of CISA's Known Exploited Vulnerabilities (KEV) catalog, detailing six critical flaws actively exploited in the wild. This includes an SQL injection in Fortinet FortiClient EMS (CVE-2026-21643), use-after-free in Adobe Acrobat Reader (CVE-2020-9715), privilege escalation via Windows CLFS driver (CVE-2023-36424), deserialization vulnerability in Microsoft Exchange Server (CVE-2023-21529), local privilege elevation in Host Process for Windows Tasks (CVE-2025-60710), and insecure library loading in Microsoft VBA (CVE-2012-1854). → thehackernews.com |
| 2026-04-14 2026 | Cisco warns of critical IMC vulnerabilities ironically the server manager itself has become a point of entry news 2 min read | Advisories detail critical Cisco IMC vulnerabilities including CVE-2026-20093, an authentication bypass allowing remote admin access, and CVE-2026-20094 through CVE-2026-20097, enabling command injection and RCE with root privileges, even for read-only users. These issues highlight the risk of neglecting "internal" management interfaces like IMC, BMC, iLO, and iDRAC, which can serve as prime entry points into data center environments. |
| 2026-04-13 2026 | Seven IBM WebSphere Liberty flaws can be chained into full takeover news 2 min read | Writeup on seven IBM WebSphere Liberty flaws, including CVE-2026-1561 for pre-authentication RCE via SAML Web SSO, CVE-2025-14915 for privilege escalation via AdminCenter, and others related to hardcoded keys and insecure archive extraction, that can be chained for full server compromise and remote code execution. → csoonline.com |
| 2026-04-13 2026 | Juniper Junos OS Multiple Vulnerabilities news 1 min read | Bulletin detailing multiple vulnerabilities in Juniper Junos OS and Junos OS Evolved. These issues, including CVE-2022-24805, CVE-2025-13914, CVE-2025-30650, and numerous others listed in the 2026-04 Security Bulletin, can lead to spoofing, data manipulation, remote code execution, denial of service, information disclosure, privilege elevation, and security restriction bypass. Remediation requires consulting Juniper's vendor website. → hkcert.org |
| 2026-04-13 2026 | Marimo RCE Flaw Exploited Within Hours of Disclosure news 3 min read | Tool for detecting and mitigating the Marimo RCE vulnerability (CVE-2026-39987), which allows pre-authentication remote code execution via an unauthenticated WebSocket endpoint. Exploitation observed within 10 hours of disclosure, targeting sensitive credentials and infrastructure. Mitigation strategies include patching, access control, credential rotation, least privilege, and enhanced monitoring. → esecurityplanet.com |
| 2026-04-13 2026 | Microsoft Edge Multiple Vulnerabilities news 2 min read | Bulletin detailing multiple vulnerabilities in Microsoft Edge, including CVE-2026-5281 which is actively exploited. Exploitation can lead to remote code execution, denial of service, security restriction bypass, data manipulation, sensitive information disclosure, and spoofing. Affected versions are prior to 147.0.3912.60. Updating to version 147.0.3912.60 or later is recommended. → hkcert.org |
| 2026-04-12 2026 | Google Chrome 147 Security Update: Patches 60 Vulnerabilities Including Critical WebML Remote Code Execution F news 5 min read | Analysis of Google Chrome 147, which patched 60 vulnerabilities including critical heap buffer overflow (CVE-2026-5858) and integer overflow (CVE-2026-5859) flaws in the WebML component. These vulnerabilities, awarded $86,000 in bug bounties, enable remote code execution via crafted web pages. The advisory details technical aspects, exploitation potential, affected versions, and mitigation strategies such as immediate patching. While no in-the-wild exploitation is reported, the significant risk necessitates vigilance, especially concerning APT groups. → rescana.com |