The newest Remote Code Execution (RCE) resources are on the Remote Code Execution (RCE) page. For a reading order instead of a date order, see the Remote Code Execution (RCE) learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-04-12 2026 | Critical Marimo pre-auth RCE flaw now under active exploitation news 2 min read | Writeup detailing CVE-2026-39987, a critical pre-authentication RCE vulnerability in Marimo versions 0.20.4 and earlier. Exploitable via the unauthenticated WebSocket endpoint '/terminal/ws', attackers can gain an interactive shell with the Marimo process's privileges. Active exploitation observed within hours of disclosure, with attackers exfiltrating credentials and SSH keys. Sysdig researchers noted a methodical operator targeting high-value information. Mitigation includes upgrading to version 0.23.0, restricting external access, or disabling the '/terminal/ws' endpoint. → bleepingcomputer.com |
| 2026-04-12 2026 | Critical Marimo Python Notebook RCE Vulnerability (CVE-2026-39987) Exploited Within 10 Hours of Disclosure news 5 min read | Analysis of CVE-2026-39987 details a critical RCE vulnerability in Marimo, an open-source Python notebook platform, allowing unauthenticated attackers shell access via a misconfigured WebSocket endpoint. Exploitation occurred within 10 hours of disclosure, focusing on credential harvesting and reconnaissance using T1190, T1552, and T1083 MITRE ATT&CK techniques. Mitigation involves upgrading to Marimo 0.23.0+, auditing logs, and rotating compromised credentials. → rescana.com |
| 2026-04-12 2026 | Adobe Patches Actively Exploited Acrobat Reader Flaw CVE-2026-34621 news 1 min read | Writeup of CVE-2026-34621, an actively exploited Adobe Acrobat Reader flaw. This prototype pollution vulnerability, with a CVSS score of 8.6, allows arbitrary code execution when users open malicious PDF documents. Adobe has released emergency updates for Acrobat DC, Acrobat Reader DC, and Acrobat 2024. Security researcher Haifei Li disclosed the zero-day exploitation, and CISA has added it to their Known Exploited Vulnerabilities catalog. → thehackernews.com |
| 2026-04-11 2026 | Google Chrome Multiple Vulnerabilities news 1 min read | Vulnerability summary detailing multiple issues within Google Chrome versions prior to 147.0.7727.55 on Linux, and 147.0.7727.55/56 on Mac and Windows. Exploitation can lead to information disclosure, denial of service, remote code execution, security restriction bypass, and data manipulation. This bulletin lists CVE-2026-5858 through CVE-2026-5919 as affected vulnerabilities. → hkcert.org |
| 2026-04-11 2026 | CVE-2026-39987: Marimo RCE exploited in hours after disclosure news 2 min read | Writeup of CVE-2026-39987 in Marimo, a Python notebook tool, detailing its pre-authenticated RCE flaw. The vulnerability, actively exploited within 10 hours of disclosure by Sysdig Threat Research Team, allowed attackers to gain a full PTY shell by targeting the unauthenticated `/terminal/ws` WebSocket endpoint. This exploit highlights the rapid threat actor response to disclosures, even for niche software like Marimo, with credential theft occurring in under three minutes. → securityaffairs.com |
| 2026-04-10 2026 | Orthanc DICOM Vulnerabilities Lead to Crashes RCE news 2 min read | Library of nine vulnerabilities, CVE-2026-5437 to CVE-2026-5445, impacting the Orthanc DICOM server, allowing for server crashes, data leaks, and remote code execution. These defects stem from insufficient metadata validation, missing checks, and unsafe arithmetic, manifesting as out-of-bounds reads, GZIP and ZIP decompression bombs, HTTP server memory exhaustion, and heap buffer overflows in image parsing and decoding logic. Versions 1.12.10 and earlier are affected; update to 1.12.11 for remediation. → securityweek.com |
| 2026-04-10 2026 | Claude uncovers a 13yearold ActiveMQ RCE bug within minutes news 2 min read | Writeup detailing CVE-2026-34197, a 13-year-old RCE vulnerability in Apache ActiveMQ Classic, uncovered by Anthropic's Claude. The flaw, exploitable via the Jolokia API and a malicious Spring XML file, allows arbitrary system command execution. Researchers used AI to build an exploit chain in minutes, highlighting the potential for AI in vulnerability discovery. This critical flaw affects ActiveMQ Classic versions prior to 5.19.4 and several 6.x releases, with an unauthenticated variant possible in some 6.x versions due to CVE-2024-32114. → csoonline.com |
| 2026-04-10 2026 | Marimo RCE Flaw CVE-2026-39987 Exploited Within 10 Hours of Disclosure news 3 min read Python | Writeup of CVE-2026-39987, a critical pre-authenticated RCE vulnerability in Marimo exploited within 10 hours of disclosure. The flaw, impacting versions prior to 0.20.4, allows unauthenticated attackers to gain a full PTY shell via the terminal WebSocket endpoint. Exploitation observed included credential theft and deployment of NKAbuse, a multi-platform threat leveraging NKN for C2. CISA added CVE-2026-39987 to its KEV catalog, mandating remediation for FCEB agencies. → thehackernews.com |
| 2026-04-10 2026 | Critical Marimo Flaw Exploited Hours After Public Disclosure news 2 min read | Writeup detailing the rapid exploitation of CVE-2026-39987, a critical unauthenticated RCE vulnerability in the Marimo reactive notebook. The flaw, discovered in the terminal WebSocket endpoint due to a lack of authentication validation, allowed attackers to gain an interactive shell and execute arbitrary commands. Exploitation began within nine hours of public disclosure, with attackers quickly moving to exfiltrate credentials and search for sensitive files like SSH keys. Releases up to Marimo 0.20.4 are affected, and users are urged to update to version 0.23.0 or newer. → securityweek.com |
| 2026-04-10 2026 | Critical Vulnerability in Ninja Forms Exposes WordPress Sites news 1 min read | Library detailing an arbitrary file upload vulnerability (CVSS 9.8) in Ninja Forms – File Upload Plugin versions up to 3.3.26. This flaw allows unauthenticated attackers to upload malicious files, including PHP scripts, through insufficient file validation and filename manipulation, potentially leading to remote code execution and full website compromise. The vulnerability was discovered by Sélim Lanouar and patched in version 3.3.27. → infosecurity-magazine.com |
| 2026-04-10 2026 | CVE-2026-21858: Ni8mare Enables Unauthenticated RCE in n8n Webhooks news 5 min read | Writeup detailing CVE-2026-21858 (Ni8mare), an unauthenticated RCE vulnerability in n8n workflow automation software. The flaw arises from content-type confusion, enabling attackers to read arbitrary files, forge admin sessions, and execute commands. This affects n8n versions prior to 1.121.0 and carries a CVSS score of 10.0. The writeup also briefly mentions CVE-2026-21877, N8scape (CVE-2025-68668), and CVE-2025-68613, which allow authenticated RCE. |
| 2026-04-10 2026 | Potentially Critical RCE in OpenSSL (CVE-2025-15467) news 3 min read | Writeup of CVE-2025-15467, a critical RCE vulnerability in OpenSSL affecting versions 3.0 through 3.6. An attacker can exploit this stack overflow by sending a crafted CMS AuthEnvelopedData message with an oversized IV, triggering a buffer overflow before authentication. This vulnerability impacts applications calling specific CMS decryption APIs or using tools like `openssl cms` and `openssl smime`, and can be leveraged for remote code execution. Users should upgrade to patched versions immediately. |
| 2026-04-10 2026 | CVE-2025-55182: React and Next.js Deserialization RCE Deep Dive intermediate | CVE-2025-55182: React and Next.js Deserialization RCE Deep Dive → akamai.com |
| 2026-04-10 2026 | Active Exploitation of 7-Zip RCE Vulnerability news 2 min read | Analysis of active exploitation of 7-Zip RCE vulnerability CVE-2025-11001, stemming from improper symbolic link handling in crafted ZIP files. Exploitation allows attackers to overwrite system files or execute arbitrary code. NHS England Digital confirmed active exploitation, urging updates to version 25.0.0 or later, which also addresses CVE-2025-11002. Unpatched systems face risks including ransomware and data theft. → blog.qualys.com |
| 2026-04-10 2026 | CVE-2025-34291 Exploited in the Wild: LangFlow AI Under Fire news 3 min read | Writeup of CVE-2025-34291, a remote code execution vulnerability in LangFlow, reveals active exploitation in the wild. This cross-site request forgery flaw, stemming from improper CORS and SameSite cookie configurations, allows attackers to impersonate logged-in users and gain full control of AI infrastructure by exploiting Python code execution capabilities. Protection involves hardening LangFlow configurations by disabling authenticated cross-site requests or restricting allowed origins, upgrading to LangFlow 1.7, or utilizing a WAF like CrowdSec to block malicious IPs. |
| 2026-04-10 2026 | CVE-2025-39601: WordPress Custom CSS, JS and PHP Plugin CSRF to RCE news 1 min read | Writeup of CVE-2025-39601, a Critical CSRF vulnerability in the WPFactory Custom CSS, JS & PHP plugin for WordPress. Versions up to and including 2.4.1 are affected, allowing unauthenticated attackers to achieve Remote Code Execution (RCE) by injecting malicious PHP code via unauthorized POST requests. Exploitation involves hosting a crafted HTML file that an authenticated administrator visits, triggering the injection of PHP code executed on page load. |
| 2026-04-10 2026 | CVE-2025-7384: Critical WordPress Plugin Unauthenticated RCE news 4 min read | Writeup of CVE-2025-7384, a critical PHP Object Injection vulnerability in the "Database for Contact Form 7, WPforms, Elementor Forms" WordPress plugin. This flaw, with a CVSS score of 9.8, allows unauthenticated attackers to inject arbitrary PHP objects, leading to denial of service and potential remote code execution through malicious deserialization. The exploit can result in the deletion of critical files like `wp-config.php`, affecting over 70,000 installations. While version 1.4.4 patches new exploits, old malicious data in the database remains a risk requiring database sanitization. |
| 2026-04-10 2026 | Sneeit WordPress RCE Exploited in the Wild news 3 min read | Writeup detailing active exploitation of CVE-2025-6389, a critical RCE vulnerability in the Sneeit Framework WordPress plugin, allowing unauthenticated attackers to execute arbitrary PHP functions like `wp_insert_user()` to create administrative backdoors. Exploitation involves crafting HTTP requests to `/wp-admin/admin-ajax.php` and uploading malicious PHP files such as "xL.php" and "up_sf.php." The report also notes concurrent attacks on ICTBroadcast, exploiting CVE-2025-2611 to deliver the "Frost" DDoS botnet, which employs spreader logic and targets specific response indicators before launching attacks. → thehackernews.com |
| 2026-04-10 2026 | Critical Unauthenticated RCE in n8n (CVE-2026-21858, CVSS 10.0) news 2 min read | Writeup on CVE-2026-21858, a critical unauthenticated RCE in n8n versions prior to 1.121.0. Exploitation involves Content-Type confusion in webhook and file-handling logic, allowing attackers to override internal parsing, access sensitive files, forge sessions, and achieve arbitrary code execution. This leads to server takeover, credential theft, and lateral movement. Orca Security aids in identifying and prioritizing remediation for vulnerable n8n instances. |
| 2026-04-10 2026 | TryHackMe Spring AI: CVE-2026-22738 RCE Writeup news | TryHackMe Spring AI: CVE-2026-22738 RCE Writeup |
| 2026-04-10 2026 | Dangerous runC Flaws Allow Hackers to Escape Docker Containers news 2 min read | Vulnerabilities in runC, CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881, allow attackers with custom mount configurations to escape Docker and Kubernetes containers by exploiting bind-mounts and symlink race conditions to gain root privileges on the host system. Fixes are available in later runC versions, and mitigations include user namespaces and rootless containers. → bleepingcomputer.com |
| 2026-04-10 2026 | runC Container Escape Vulnerabilities: A Technical Overview intermediate 3 min read | Writeup of runc container escape vulnerabilities, including CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881, which allow arbitrary writes to procfs files. Exploitation involves custom mount configurations, potentially leading to host compromise in environments like Kubernetes. Mitigations include updating runc to v1.4.0-rc.3, v1.3.3, or v1.2.8, and employing user namespaces, non-root users, and security modules. |
| 2026-04-10 2026 | New runC Vulnerabilities Allow Container Escape in Docker and Kubernetes news 3 min read | Analysis of three runc vulnerabilities, CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881, details how attackers can achieve container escape in Docker and Kubernetes. These exploits leverage race conditions and mount manipulations, specifically involving maskedPaths abuse and /dev/console mount races, to gain root access to host systems by writing to critical procfs files. Mitigation strategies include updating runc, enabling user namespaces, and using rootless containers. |
| 2026-04-10 2026 | Attackers Exploit Critical Langflow RCE as CISA Sounds Alarm news 2 min read | Library for detecting and mitigating remote code execution in Langflow, particularly CVE-2026-33017. This vulnerability allows unauthenticated attackers to execute arbitrary Python code by submitting malicious workflow data via the `build_public_tmp` endpoint. Attackers have weaponized this flaw within hours of disclosure, leading to credential exfiltration and potential software supply chain compromise. Runtime detection is crucial, focusing on exploit behavior like shell command execution and data exfiltration over HTTP, rather than specific CVE signatures. → csoonline.com |
| 2026-04-10 2026 | CVE-2026-33017: How Attackers Compromised Langflow AI Pipelines in 20 Hours intermediate 8 min read | Writeup detailing CVE-2026-33017, an unauthenticated RCE in Langflow, exploited within 20 hours of its advisory. Attackers leveraged the vulnerability's public flow build endpoint to execute arbitrary Python code, exfiltrating credentials and potentially compromising supply chains. Exploitation attempts observed included automated scanning via nuclei templates and custom Python scripts for deeper reconnaissance and data harvesting, highlighting the rapid weaponization trend of newly disclosed vulnerabilities. |
| 2026-04-10 2026 | CVE-2025-3248: RCE Vulnerability in Langflow news 3 min read | Writeup detailing CVE-2025-3248, a critical remote code execution (RCE) vulnerability in Langflow. Exploitation of the `/api/v1/validate/code` endpoint allows unauthenticated arbitrary command execution by embedding malicious Python code within decorators or default function arguments, which are evaluated during AST processing prior to version 1.3.0. Recommendations include immediate upgrades, access restriction via ZTNA, input sandboxing, and monitoring. |
| 2026-04-10 2026 | React2Shell Explained: From Vulnerability Discovery to Exploitation intermediate 13 min read | Library for understanding CVE-2025-55182, the React2Shell vulnerability. This exploit targets React Server Components' React Flight protocol by abusing unsafe deserialization of client-controlled payloads. Successful exploitation allows unauthenticated attackers to achieve remote code execution (RCE) on vulnerable servers, impacting applications built with React 19.0.0-19.2.0 and Next.js App Router versions 16.0.0-16.0.6. The analysis details how attackers manipulate prototype chains and the Function constructor to inject malicious code. → resecurity.com |
| 2026-04-10 2026 | Protecting Against the Critical React2Shell RCE Exposure intermediate 5 min read | Library for identifying and mitigating the critical 'React2Shell' RCE vulnerability (CVE-2025-55182) affecting React Server Components and Next.js. This vulnerability allows unauthenticated attackers to perform server-side code execution via insecure deserialization in the RSC 'Flight' protocol. The library helps secure environments by detailing immediate actions, providing detection rules, and showcasing how SentinelOne's Offensive Security Engine can verify exploitability of affected workloads. → sentinelone.com |
| 2026-04-10 2026 | React2Shell: Node.js RCE Against a Production Next.js App advanced 52 min read | Analysis of CVE-2025-55182, "React2Shell," details a Node.js Remote Code Execution vulnerability in Next.js applications utilizing React Server Components. The exploit leverages the Flight protocol's unsafe deserialization to trigger `child_process.spawnSync()`, allowing arbitrary shell commands with server process privileges. The report reconstructs a six-stage attack campaign, including C2 communication across multiple servers and the use of Lachlan Davidson's "02-meow-rce-poc" for RCE confirmation, despite defensive measures like container restrictions limiting further attacker progression. |
| 2026-04-10 2026 | CVE-2025-68613: RCE via Expression Injection in n8n news 14 min read | Writeup of CVE-2025-68613, a critical RCE vulnerability in n8n's expression evaluation engine. This flaw allows authenticated users to inject malicious JavaScript expressions, escaping the sandbox to execute arbitrary code on the server with n8n process privileges. Exploitation enables attackers to run OS commands, steal secrets, modify files, and gain full server control, impacting over 100,000 instances globally. The vulnerability affects versions from 0.211.0 up to 1.120.3 and early 1.122.x releases, with fixes available in versions 1.120.4, 1.121.1, and 1.122.0+. → resecurity.com |
| 2026-04-10 2026 | Adobe Reader Zero-Day Exploited via Malicious PDFs Since December 2025 news 2 min read | Writeup of CVE-2026-34621, a zero-day vulnerability in Adobe Reader exploited since December 2025 via malicious PDFs. This sophisticated exploit, first observed in "Invoice540.pdf," uses obfuscated JavaScript to harvest sensitive data and potentially deliver subsequent payloads for remote code execution and sandbox escape. The exploit targets privileged Acrobat APIs and has been confirmed to work on the latest Adobe Reader version, necessitating user vigilance and prompt application of the provided security update. → thehackernews.com |
| 2026-04-10 2026 | From Pre-Auth SSRF to RCE in TruFusion Enterprise intermediate 2 min read | Writeup detailing pre-authentication SSRF (CVE-2025-32355) and path traversal (CVE-2025-59793) vulnerabilities in TRUfusion Enterprise. The SSRF allows an attacker to abuse a misconfigured reverse proxy to access internal services, including an Axis2 interface. This Axis2 service, vulnerable to path traversal, can be exploited with the default 'trubiquity' password to achieve remote code execution by writing arbitrary files to the filesystem. |
| 2026-04-10 2026 | Serverless Security Risks 2026: Mitigating SSRF and RCE Threats intermediate 17 min read SSRF | Library for serverless security, detailing risks like SSRF and RCE by focusing on identity, permissions, and configuration. It explains how short-lived cloud credentials for AWS Lambda, Azure Functions, and Google Cloud Functions become primary targets when exposed, enabling privilege escalation and lateral movement. The library emphasizes that interconnected services, shared dependencies, and insufficient visibility into invocation paths and configurations compound these risks, advocating for continuous monitoring and least-privilege enforcement. → blog.qualys.com |
| 2026-04-10 2026 | Intigriti Challenge: SSRF to RCE via File Upload Bypass intermediate | Intigriti Challenge: SSRF to RCE via File Upload Bypass |
| 2026-04-10 2026 | OpenMetadata RCE via SSTI in FreeMarker Email Templates intermediate 4 min read SSTI | Writeup of GHSA-5f29-2333-h9c7, detailing a critical Remote Code Execution vulnerability in OpenMetadata version 1.11.2. The vulnerability stems from Server-Side Template Injection (SSTI) within FreeMarker email templates, allowing an administrator to inject malicious code that is then executed by the server. Attack vectors include privilege escalation, data exfiltration, and establishing reverse shells, with significant impacts on confidentiality, integrity, and availability. |
| 2026-04-10 2026 | RCE in Airbyte via Server-Side Template Injection (SSTI) intermediate | Library for securing Airbyte connections, preventing Remote Code Execution (RCE) via Server-Side Template Injection (SSTI) in the connection builder Docker image. This vulnerability, discovered by Mike Cole of Mantel Group, could allow authenticated attackers to execute arbitrary code and expose sensitive information like credentials if a new connector is tested on a compromised instance. |
| 2026-04-10 2026 | File Upload Vulnerability Testing: Bypassing Filters and Getting RCE intermediate 4 min read | Guide detailing techniques for bypassing file upload filters to achieve Remote Code Execution (RCE). It covers extension filter bypasses, including alternative extensions like `.php5`, `.phtml`, `.phar`, and double extensions, as well as Content-Type and magic byte manipulation. The guide also explores filename manipulation for path traversal, `.htaccess` uploads to enable PHP execution for any extension, and exploitation of image processing vulnerabilities like ImageMagick's CVE-2016-3714. It provides web shell payloads and discusses chaining file uploads with other vulnerabilities such as LFI, SSRF, XSS, and XXE. |
| 2026-04-10 2026 | Critical LFI to RCE in WP Ghost Plugin Affecting 200k+ Sites intermediate 3 min read | Writeup of CVE-2025-26909, a critical unauthenticated Local File Inclusion (LFI) to Remote Code Execution (RCE) vulnerability in the WP Ghost WordPress plugin, affecting over 200,000 sites. The vulnerability arises from insufficient sanitization of user input in the `showFile` function, allowing path traversal and arbitrary file inclusion, potentially leading to RCE via techniques like `php://filter` chains or `PHP_SESSION_UPLOAD_PROGRESS`. The issue is fixed in version 5.4.02. |
| 2026-04-10 2026 | CVE-2026-22812: RCE on a 71k-Star AI Coding Tool With Zero Auth news | CVE-2026-22812: RCE on a 71k-Star AI Coding Tool With Zero Auth |
| 2026-04-10 2026 | Root in One Request: Marimo's Critical Pre-Auth RCE (CVE-2026-39987) news 8 min read | Writeup of CVE-2026-39987, a critical pre-authentication remote code execution vulnerability in the Marimo Python reactive notebook framework. This issue, with a CVSS v4.0 score of 9.3, stems from an unauthenticated WebSocket endpoint for the integrated terminal, allowing attackers to gain an interactive shell as the Marimo process user. The vulnerability has been exploited in the wild, and vulnerable instances are believed to be widespread. Marimo versions prior to 0.23.0 are affected. → endorlabs.com |
| 2026-04-10 2026 | Lessons From 2025: Zero-Day Exploitation Shaping 2026 news 6 min read | Analysis of 2025 zero-day exploitation reveals critical vulnerabilities in enterprise software like Oracle EBS (CVE-2025-61882), Meta React Server Components (CVE-2025-55182), SAP NetWeaver (CVE-2025-31324), Microsoft SharePoint (CVE-2025-53770), and Citrix NetScaler (CVE-2025-5777). Financially motivated groups and China-aligned actors were prominent exploiters, demonstrating rapid weaponization of public disclosures and the lingering risk even after patches are released. Enterprise software's central role made it a prime target, with exploitation leading to widespread compromise and extortion. |
| 2026-04-10 2026 | Cisco Patches Zero-Day RCE Exploited by China-Linked APT news 2 min read | Reference detailing CVE-2025-20393, a critical remote command execution flaw in Cisco AsyncOS Software for Secure Email Gateway and Web Manager. Exploited by China-linked APT UAT-9686, this vulnerability, with a CVSS score of 10.0, allows arbitrary root command execution via insufficient validation of HTTP requests to the Spam Quarantine feature. Attackers deployed tools like ReverseSSH, Chisel, AquaPurge, and AquaShell. Cisco has released patches and recommends hardening guidelines, including firewalling, disabling unnecessary services, and enforcing strong authentication. → thehackernews.com |
| 2026-04-10 2026 | Critical Redis RCE Vulnerability: CVE-2025-49844 news 5 min read | Writeup on CVE-2025-49844, dubbed #RediShell, detailing a critical Use-After-Free (UAF) vulnerability in Redis. This flaw allows authenticated attackers to execute arbitrary native code on the Redis host by escaping the Lua sandbox with a crafted Lua script. Given Redis's prevalence in cloud environments, this vulnerability poses a significant risk, potentially leading to data exfiltration, lateral movement, and system compromise. The writeup also highlights affected forks like Valkey and managed services such as Amazon ElastiCache, Google Cloud Memorystore, and Azure Cache for Redis. → wiz.io |
| 2026-04-10 2026 | CVE-2025-59287: WSUS Unauthenticated RCE Vulnerability news 5 min read | Writeup detailing CVE-2025-59287, a critical (CVSS 9.8) unauthenticated RCE vulnerability in Windows Server Update Services (WSUS). The flaw stems from unsafe deserialization via .NET BinaryFormatter in WSUS reporting web services, allowing attackers to execute arbitrary code with SYSTEM privileges. Exploitation involves crafted SOAP requests to the GetCookie endpoint containing an encrypted gadget chain payload. Microsoft has released an out-of-band update, and active exploitation has been observed in the wild. → picussecurity.com |
| 2026-04-10 2026 | Ivanti EPMM RCE Vulnerability Chain Exploited in the Wild news 6 min read | Writeup detailing the exploitation of Ivanti EPMM by CVE-2025-4427 and CVE-2025-4428, a chain enabling unauthenticated RCE. The attack bypasses authentication via misconfigured Spring Security and leverages Java Expression Language injection for code execution. Observed in-the-wild activity includes Sliver beacon C2 communication, MySQL database dumping, deployment of JSP web shells, and direct reverse shells. Affected versions include 11.12.0.4 and prior, 12.3.0.1 and prior, 12.4.0.1 and prior, and 12.5.0.0 and prior. → wiz.io |
| 2026-04-10 2026 | CVE-2025-34291: Critical Account Takeover and RCE in Langflow news 7 min read AuthN | Library detailing CVE-2025-34291, a critical vulnerability in Langflow enabling account takeover and RCE through a chain involving permissive CORS settings, SameSite=None for the refresh token cookie, and the unauthenticated `/api/v1/refresh` endpoint, allowing attackers to steal valid access tokens and subsequently exploit the `/api/v1/validate/code` endpoint for code execution. |
| 2026-04-10 2026 | Critical Langflow RCE Flaw Exploited in the Wild Within Hours news 3 min read | Writeup of CVE-2026-33017, a critical unauthenticated RCE in Langflow, detailing its exploitation within hours of disclosure. The vulnerability allows attackers to execute arbitrary Python code on exposed instances via the public flow build endpoint. Exploitation attempts involved mass scanning, reconnaissance, and data exfiltration of API keys for OpenAI, Anthropic, and AWS, leading to potential downstream compromises of AI pipelines and connected data stores. |
| 2026-04-10 2026 | CVE-2026-20131: Analysis of Cisco FMC RCE news 4 min read | Analysis of CVE-2026-20131, a critical RCE vulnerability affecting Cisco Secure Firewall Management Center (FMC) Software, details how unauthenticated attackers can execute arbitrary Java code via a specially crafted serialized Java object. This vulnerability, actively exploited in the wild and added to CISA's KEV catalog, allows root privilege escalation and poses a significant risk to network security by potentially compromising entire infrastructures managed by FMC. Exploitation involves sending malicious HTTP requests triggering insecure deserialization, enabling post-exploitation activities like data exfiltration and backdoor installation. |
| 2026-04-10 2026 | n8n Critical Vulnerability (CVE-2026-21858): Unauthenticated RCE news 7 min read | Writeup of CVE-2026-21858, an unauthenticated RCE in n8n, allowing full compromise of locally deployed instances through arbitrary file access, authentication bypass, and command execution. Discovered by Cyera Research Labs and nicknamed 'Ni8mare', this vulnerability highlights automation platforms as high-impact attack surfaces. Remediation involves upgrading n8n, restricting exposure of Forms and Webhooks, and reviewing workflow configurations. → aikido.dev |
| 2026-04-10 2026 | Critical Telnetd Flaw (CVE-2026-32746) Enables Root RCE news 3 min read | Writeup of CVE-2026-32746, a critical out-of-bounds write vulnerability in GNU InetUtils telnetd's LINEMODE Set Local Characters suboption handler. This flaw allows unauthenticated remote attackers to execute arbitrary code as root by sending crafted messages during the initial connection handshake. Discovered by Dream, it affects versions through 2.7 and impacts various systems including FreeBSD, NetBSD, and TrueNAS Core. → thehackernews.com |