The newest Remote Code Execution (RCE) resources are on the Remote Code Execution (RCE) page. For a reading order instead of a date order, see the Remote Code Execution (RCE) learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-08-14 2026 | Ruby 4.0 Universal RCE Deserialization Gadget Chain - elttam intermediate 12 min read Deser | Library releasing a new universal RCE deserialization gadget chain for Ruby 4.0.6, building on research into previous Ruby on Rails vulnerabilities. This chain targets `Marshal.load` and leverages gadgets from `Gem::SpecFetcher`, `Gem::Specification`, and `Gem::StubSpecification` to achieve command execution by controlling file content written to disk via `Gem::URI::Generic` and triggering `eval`. The exploit is designed to bypass recent patches in RubyGems, specifically those addressing `Gem::Version` and `Gem::Source::Git` exploits. → elttam.com |
| 2026-08-13 2026 | Unpatched GeoServer Zero-Day Targeted in Active Exploitation Attempts Can Lead to RCE news 1 min read | Library detailing an unpatched GeoServer zero-day SQL injection vulnerability, allowing for remote code execution (RCE). This flaw, disclosed on August 12, 2026, is actively being exploited and remains unfixed, with hundreds of probing attempts observed. Previous GeoServer vulnerabilities, including CVE-2024-36401, have also been actively exploited for malicious purposes. → thehackernews.com |
| 2026-08-13 2026 | Critical VMware vCenter RCE flaw exploited for reverse SSH access news 2 min read | Writeup on CVE-2026-59310, a critical directory traversal vulnerability in VMware vCenter Syslog Server, actively exploited for arbitrary code execution. Attackers leverage this flaw to deploy the open-source `reverse_ssh` framework for persistence and remote access, establishing outbound command-and-control channels. QUIRSO has released a YARA rule to detect `reverse_ssh` client binaries. The campaign has targeted systems across 47 countries, with significant activity observed in Germany, the U.S., Turkey, Iran, and France. → bleepingcomputer.com |
| 2026-08-13 2026 | Critical VMware vCenter Vulnerability in Attackers Crosshairs news 2 min read | Writeup detailing the exploitation of CVE-2026-59310, a critical directory traversal vulnerability in VMware vCenter's Syslog server, which enables remote code execution. Threat actors, including an APT group, are actively targeting vulnerable vCenter instances, using a reverse shell framework called `reverse_ssh` for persistent access. Quirso has developed a YARA rule to help detect `reverse_ssh` artifacts, recommending validation through checks for unauthorized installations and unexpected outbound connections. → securityweek.com |
| 2026-08-13 2026 | CVE-2026-53360: KVM SEV-SNP guest-to-host heap OOB and analysis of the upstream fix advanced 20 min read | Analysis of CVE-2026-53360 in KVM's SEV-SNP demonstrates a heap out-of-bounds read/write vulnerability. A malicious guest VM can exploit the Page State Change handler by providing a crafted buffer size and entry count, leading to host kernel heap corruption and memory layout leakage. The vulnerability, fixed in mainline commit db3f2195d293 and patched in kernel versions v7.0.12, v6.18.35, and v6.12.93, arises from insufficient bounds checking against the allocated buffer size when processing PSC entries, allowing reads and writes far beyond the intended 2032-byte GHCB Shared Buffer. |
| 2026-08-12 2026 | Zoom Zero-Click RCE: AI Helped Build an Exploit in Under 24 Hours news 5 min read | Writeup on the ZOOMSDAY exploit chain, detailing a zero-click RCE vulnerability affecting Zoom clients across Windows, macOS, iOS, and Android. The chain, involving CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415, leveraged memory corruption in the annotation feature. Researchers developed a working exploit in under 24 hours with AI assistance, highlighting the collapsing barrier for offensive security research and the potential impact on collaboration platforms. → techrepublic.com |
| 2026-08-12 2026 | Zoom Flaws Facilitate Zero-Click Remote Code Execution news 3 min read | Writeup of "Zoomsday" vulnerabilities (CVE-2026-53415, CVE-2026-53413, CVE-2026-53414) in Zoom's annotation feature, enabling zero-click remote code execution. Exploits targeting memory corruption flaws allow attackers to take complete control of a victim's device during calls, steal data, or spy. While Zoom has patched these issues, users must update their clients, as server-side mitigations are ineffective with end-to-end encryption enabled. Reducing attack surface through meeting access controls and validating endpoint controls are recommended defenses. → bankinfosecurity.com |
| 2026-08-12 2026 | Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws news 2 min read | Patches address multiple critical vulnerabilities in Adobe ColdFusion, Commerce, and Campaign Classic, including CVSS 10.0 flaws like CVE-2026-48362 (OS command injection) and CVE-2026-71398 and CVE-2026-27302 (incorrect authorization leading to arbitrary code execution). Other notable vulnerabilities include CVE-2026-48273 (eval injection) and CVE-2026-71362 (incorrect authorization in Commerce, reportedly exploited by threat actors). Adobe recommends immediate installation of updates for affected products. → thehackernews.com |
| 2026-08-12 2026 | SAP Commerce Cloud Flaw Could Let Unauthenticated Attackers Execute Arbitrary Code news 2 min read | Writeup of CVE-2026-58231, a maximum-severity flaw in SAP Commerce Cloud's Data Hub Adapter, enabling unauthenticated attackers to achieve arbitrary code execution through insufficient authorization and validation. This critical vulnerability, alongside three others (CVE-2026-44772, CVE-2026-34265, CVE-2026-44758) impacting Manufacturing Integration and Intelligence and Application Server ABAP, was patched by SAP. Onapsis recommends patching and specific configurations, such as IP filtering and secure transformer properties, to mitigate risks including server-side template injection and request forgery. → thehackernews.com |
| 2026-08-12 2026 | CopyEscape: Container-to-host arbitrary file write via docker cp (CVE-2026-17106) news 11 min read | Writeup of CVE-2026-17106, a container-to-host arbitrary file write vulnerability in Docker's `docker cp` command, allows attackers to overwrite host files or achieve code execution. The exploit chains a filesystem race in the archive pipeline, enabling a running container to produce an inconsistent tar archive, with an extraction flaw that allows the Docker CLI to follow a planted symlink outside the intended destination. This impacts CI systems, developer workstations, and AI-agent workflows utilizing Docker Sandboxes. → imperva.com |
| 2026-08-11 2026 | Microsoft Patch Tuesday for August 2026 Snort rules and prominent vulnerabilities news 10 min read | Ruleset for Microsoft's August 2026 Patch Tuesday, detailing 421 vulnerabilities including 62 critical ones. Highlights include CVE-2026-62893 (Windows Deployment Services TFTP Server RCE), CVE-2026-65657 (Microsoft SharePoint Server RCE), CVE-2026-62823 (Windows DHCP Server RCE), and CVE-2026-68820 (Windows Ancillary Function Driver for WinSock EoP). The ruleset addresses a range of vulnerability types like Use After Free, Deserialization of Untrusted Data, Heap-based Buffer Overflow, and Integer Overflow. → blog.talosintelligence.com |
| 2026-08-11 2026 | Zoom Patches Zero-Click Code Execution Vulnerability news 2 min read | Writeup of Zoomsday (CVE-2026-53413), a zero-click RCE vulnerability in Zoom's annotator function. A Security discovered that a missing bound check allowed specially crafted messages sent over Zoom's proprietary annotator protocol to corrupt memory, leading to code execution on other meeting participants' machines. The exploit enables attackers to gain control of a victim's machine without any user interaction or visual indication. Patches are available in Zoom clients and SDK versions 7.1.5 and 7.0.6 for affected platforms. → securityweek.com |
| 2026-08-11 2026 | Rapid7 and Microsoft disclose CVE-2026-63520 a new SharePoint Remote Code Execution vulnerability news 6 min read | Writeup of CVE-2026-63520, a critical unauthenticated RCE vulnerability in Microsoft SharePoint discovered by Rapid7 Labs. This vulnerability, caused by an unsafe .NET type instantiation in Business Connectivity Services, can be chained with CVE-2026-55040 to achieve arbitrary code execution on affected servers. The research also explored the use of AI models in vulnerability discovery against complex enterprise targets like SharePoint. → rapid7.com |
| 2026-08-11 2026 | Researchers Disclose AI-Assisted SharePoint Exploit Chain Reaching Unauthenticated RCE intermediate 3 min read | Writeup detailing CVE-2026-55040 and CVE-2026-63520, an AI-assisted exploit chain for unauthenticated RCE in SharePoint Server Subscription Edition, 2019, and 2016. The chain bypasses authentication by assuming a target user's identity and then leverages an unsafe .NET type instantiation vulnerability. Researchers used an AI agent to discover the exploit path, though human guidance was essential. July updates are stated to break the chain, with August updates expected to fully remediate. → thehackernews.com |
| 2026-08-11 2026 | Python Software Foundation - Python 3.11.0a3 to 3.15.0b2 news 12 min read Python | Writeup detailing CVE-2026-12003, an Uncontrolled Search Path Element vulnerability in Python versions 3.11.0a3 to 3.15.0b2. This vulnerability, affecting Windows installations, allows low-privilege users to escalate privileges by manipulating file paths to achieve arbitrary code execution when a privileged user or service account launches an affected Python interpreter. Exploitation requires a Windows environment, specific directory creation permissions for low-privilege users, and a privileged user executing Python post-manipulation. → bishopfox.com |
| 2026-08-09 2026 | Analyzing a Multi-Stage PowerShell Payload Chain advanced 6 min read | Writeup of a multi-stage PowerShell payload chain involving Vercel-hosted infrastructure. The analysis details the retrieval and execution of ZIP archives containing executables, employing techniques like dynamic IEX, Base64, and repeating-key XOR obfuscation with the key "write." The process includes downloading payloads such as Grape2.zip, UltraToolliteSetup.exe, and draw.zip, with decoy "Verification complete!" messages observed. |
| 2026-08-09 2026 | Write Once, Shell Everywhere - Turning Arbitrary File Writes into RCE (DEF CON Bug Bounty Village) intermediate 20 min read Talks | Library of techniques for escalating arbitrary file writes to remote code execution, detailing the current state of the art across operating systems and language runtimes. It catalogues existing methods and introduces new techniques for stripped-down containers, focusing on environmental fingerprinting and exploitation strategies against common execution sinks, such as `/etc/ld.so.preload`. |
| 2026-08-09 2026 | DEF CON talk: 8 in 10 Banks in Belgium HATE This One Weird eID RCE news 13 min read Talks | Talk slides from DEF CON detail critical vulnerabilities in the Connective signing extension, impacting over 2 million users primarily in Belgium. Researchers discovered that any website could extract users' eID PINs and Maestro card data, and crucially, trigger remote code execution (RCE) by exploiting how the native binary loaded attacker-supplied libraries, effectively bypassing user consent for sensitive operations like eIDAS qualified signatures. |
| 2026-08-08 2026 | Progress Kemp LoadMaster Flaw Hits CISA KEV After 792 Reported Exploit Attempts news 1 min read | Writeup on CVE-2026-8037, a critical command injection vulnerability in Progress Kemp LoadMaster. This flaw, with a CVSS score of 9.6, allows unauthenticated attackers to execute arbitrary commands by exploiting unsanitized input in multiple command endpoints, as analyzed by watchTowr Labs and highlighted by CISA's addition to the KEV catalog. Over 792 exploitation attempts have been observed from 18 countries, prompting urgent patching recommendations for federal agencies. → thehackernews.com |
| 2026-08-07 2026 | Rapid7 Analysis of CVE-2026-63077 an unauthenticated Remote Code Execution vulnerability in JetBrains TeamCity news 14 min read | Analysis of CVE-2026-63077, an unauthenticated RCE vulnerability in JetBrains TeamCity, reveals an unsafe deserialization flaw in the agent polling protocol. The vulnerability arises from an overly permissive XStream allowlist that fails to clear default permissions, allowing the deserialization of dangerous Java classes like `Map` and `Throwable`. A patched TeamCity server remediates this by adding `NoTypePermission.NONE` to clear existing permissions before applying its own allowlist, effectively creating a deny-by-default baseline. This fix prevents attackers from exploiting the flaw to execute arbitrary operating system commands. → rapid7.com |
| 2026-08-07 2026 | New WordPress Pre-Auth XSS Could Lead to PHP Code Execution news 4 min read | Library for identifying and mitigating a critical pre-authentication reflected XSS vulnerability (CVE-2026-64638) in WordPress, which can be chained to achieve PHP code execution. The vulnerability, discovered by pwn.ai, affects all versions of WordPress and allows attackers to exploit crafted usernames to inject JavaScript on the failed-login error page, leading to potential RCE through techniques like Application Password creation and plugin upload. The library likely aids in detecting this specific flaw and understanding its exploitation path, building upon prior research such as Paulos Yibelo's SOME technique. → thehackernews.com |
| 2026-08-07 2026 | Zbtlink Routers Contain rctl Backdoor news 8 min read | Writeup on ENDLESSDOORS, a backdoor found in Zbtlink and other white-labeled routers. This implant, a customized version of the rctl tool, allows for remote command execution and reverse shell capabilities by exploiting a vulnerability present in numerous firmware images across models like Z8102AX-2DSIM and WG3526. The backdoor phones home to specific endpoints, enabling attackers to hijack communications and gain root access without inbound connectivity. Affected devices should be identified by model number and checked for the presence of the 'kworker' process and associated files. → vulncheck.com |
| 2026-08-07 2026 | Claude Code RCE: How a Malicious PR Triggers Code Execution news 9 min read | Writeup detailing a Claude Code RCE vulnerability, triggered by a malicious pull request that exploits the `.mcp.json` configuration file. When a developer trusts a repository and opens Claude, the tool automatically executes commands defined in `.mcp.json` to enumerate MCP servers. Attackers can place malicious commands within this file, leading to arbitrary code execution, secret exfiltration, and reverse shells on the developer's host, leveraging tools like `netcat`, `npx`, or `docker` for execution. |
| 2026-08-07 2026 | Critical RCE in IBM Langflow Triggers CISA Emergency Deadline news 2 min read | Writeup of CVE-2026-9198, a critical RCE in IBM Langflow exploited by unauthenticated callers to mint SUPERUSER tokens and execute arbitrary Python code. This vulnerability, rated CVSS 9.8, triggered a CISA emergency deadline for federal agencies, requiring remediation to Langflow 1.10.2, disabling `LANGFLOW_AUTO_LOGIN`, and restricting API access. Recurring severe vulnerabilities like CVE-2026-33017 and CVE-2026-55255 highlight ongoing security risks in AI agent infrastructure. → cryptorank.io |
| 2026-08-07 2026 | Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org-Mode Markup news 2 min read | Library update patching Gitea versions 1.22.1 through 1.27.0 addresses CVE-2026-59774, a Critical file-read vulnerability. Unauthenticated attackers could exploit this via crafted Org-mode markup with #+INCLUDE directives to read any file accessible by the Gitea service account, potentially escalating to remote code execution by reading app.ini and exfiltrating INTERNAL_TOKEN. The vulnerability, found by XBOW Security and Guido Leo, and independently by Shai Rod, is fixed in Gitea 1.27.1, which also patches CVE-2026-60004. → thehackernews.com |
| 2026-08-06 2026 | Critical Paperclip Flaw Allowed Admin Access Code Execution news 2 min read | Writeup on CVE-2026-41679, a critical authorization bypass in the Paperclip AI management platform. This vulnerability, with a CVSS score of 10, allowed unauthenticated remote attackers to gain arbitrary code execution with server permissions. Exploitation involved self-registering an account, approving a CLI challenge, and then importing a crafted YAML file to deploy an agent that executes commands as the Paperclip server process. The flaw was patched by implementing authorization checks in import flows and tightening company scoping. → securityweek.com |
| 2026-08-06 2026 | Active Exploitation Alert: Critical Gitea CVE-2026-59774 Lets Unauthenticated Attackers Read Server Files and Gain RCE news 4 min read | Writeup of CVE-2026-59774, a critical Gitea vulnerability allowing unauthenticated attackers to perform arbitrary file reads and potentially achieve RCE via Org-mode markup injection. Exploitation involves crafting payloads for the `/markup` endpoint, affecting Gitea versions v1.22.1 through v1.27.0. This path traversal flaw (CWE-22) is actively exploited in the wild, enabling access to sensitive files like `app.ini` and subsequent command execution through Git hook manipulation. → rescana.com |
| 2026-08-05 2026 | Pre-auth RCE in enterprise Java hits Bonita and OFBiz servers news 4 min read | Writeup of CVE-2026-31986, detailing pre-authentication remote code execution in Bonita and Apache OFBiz enterprise Java applications. Attackers exploit chained vulnerabilities, including improper path handling, insecure deserialization via XStream, and forged single sign-on tokens, to achieve code execution without authentication. These flaws were discovered by Novee researchers and presented at Black Hat USA 2026, with vendors releasing patched versions. → helpnetsecurity.com |
| 2026-08-05 2026 | Code Execution via Provisioning Packages intermediate 5 min read | Library for abusing Windows Provisioning Packages (.ppkg) to execute arbitrary code. Threat actors can disguise malicious payloads within these containers, which are used by administrators for device configuration. The library leverages the Windows Imaging and Configuration Designer (ICD.exe) to create malicious packages, with extracted commands residing in `customizations.xml` and executable via `provtool.exe`. Detection methods include monitoring the Microsoft-Windows-Provisioning-Diagnostics-Provider event log (event ID 20 for package application, event ID 10 for associated file information) and auditing file system access to `C:\ProgramData\Microsoft\Provisioning` and temporary staging directories. → ipurple.team |
| 2026-08-05 2026 | HEVD: From Stack Overflows to Modern Pool Grooming advanced 1 min read | Library containing C++ source code and exploit scripts for the HackSys Extreme Vulnerable Driver (HEVD) on modern x64 Windows 11. This four-part series details the evolution of Ring 0 exploitation, covering stack buffer overflows with SMEP bypass and DKOM token stealing, arbitrary writes with stack pivoting and kernel stack reconstruction, kernel pool grooming for data-only attacks using out-of-bounds reads and named pipes, and weaponizing npfs.sys with double-pipe grooming for _EPROCESS token swaps, achieving stable local privilege escalation. |
| 2026-08-05 2026 | Hardware Hacking: From zero to a Pre-Auth Stack Buffer Overflow on Amazon's best-selling router advanced 13 min read | Library detailing hardware hacking techniques applied to the Mercusys MB115-4G router, culminating in a pre-authentication stack buffer overflow. The resource covers identifying UART interfaces, extracting firmware with binwalk, analyzing boot scripts, and cracking weak MD5-hashed passwords like "1234" found in `passwd.bak`. It also discusses component identification, including Ethernet transformers, SPI flash memory, and the 4G LTE module, offering a practical approach to gaining root shell access and performing static analysis on embedded devices. |
| 2026-08-04 2026 | Before the first prompt: Code execution paths in trusted coding-agent projects advanced 6 min read AI | Library for identifying code execution paths in trusted coding-agent projects, demonstrating how configurations like Codex's Model Context Protocol (MCP) and Claude Code's project-controlled PATH can trigger attacker-controlled processes before the first user prompt, bypassing typical hook reviews. The library highlights that vulnerabilities extend beyond malicious hooks and skills, encompassing editor tasks, environment settings, and runtime startup files. → securitylabs.datadoghq.com |
| 2026-08-04 2026 | Cruising for Shells in Flowise - elttam intermediate 25 min read API Sec | Tool for analyzing and exploiting Remote Code Execution (RCE) vulnerabilities in Flowise, a generative AI development platform. It details findings including RCE via pandas in the CSVAgent node, arbitrary file writes in SQL Database Chain and SQLite Record Manager nodes, and bypasses for the `validatePythonCodeForDataFrame` function. The analysis covers multiple CVEs and GHSA identifiers, demonstrating how attackers can leverage insecure Python code execution and TypeORM DataSource initialization to gain shell access. → elttam.com |
| 2026-08-04 2026 | Rapid7 Analysis: KindaRails2Shell (CVE-2026-66066) news 14 min read | Analysis of CVE-2026-66066 reveals an arbitrary file read vulnerability in Ruby on Rails Active Storage when using the Vips image processor with untrusted uploads. Versions of Active Storage < 7.2.3.2, >= 8.0, < 8.0.5.1, and >= 8.1, < 8.1.3.1 are affected. The exploit involves crafting a MAT/HDF5 file disguised as an image (e.g., `image/png`) and submitting it via direct upload. A legitimate `variation_key` from the same application can then be reused to trigger libvips' `matload` function, leading to arbitrary file reads and potentially remote code execution (RCE) through `Kernel#spawn` or `Kernel#eval`. → rapid7.com |
| 2026-08-03 2026 | Hugging Face Diffusers Flaws Could Let Model Repositories Execute Arbitrary Code news 3 min read | Library of flaws named FaceHugger in Hugging Face's Diffusers allows crafted model repositories to execute arbitrary code, bypassing the `trust_remote_code` safeguard. Three high-severity vulnerabilities, CVE-2026-44827, CVE-2026-45804, and CVE-2026-44513, exploit TOCTOU race conditions and code injection through custom pipelines and configuration files. These flaws present a significant AI supply chain risk, enabling initial access through model loading processes. The issues were patched in Diffusers version 0.38.0. → thehackernews.com |
| 2026-08-03 2026 | Ruby on Rails Patches Critical Active Storage Vulnerability Affecting Image Processing news 2 min read | Library update addressing CVE-2026-66066, a critical Ruby on Rails Active Storage vulnerability affecting image processing with libvips. This flaw allows unauthenticated attackers to read arbitrary files, potentially exposing sensitive data like `secret_key_base` and credentials, leading to remote code execution or lateral movement. Users must upgrade Active Storage, ensure libvips is 8.13+, and rotate all compromised secrets. → securityaffairs.com |
| 2026-08-01 2026 | Full Rails RCE technical writeup... KindaRails2Shell: How a MATLAB file reads your secrets and pops a shell on Ruby on Rails | Ethiack intermediate 11 min read Secrets | Library analyzing an arbitrary file read to RCE chain in Ruby on Rails applications, dubbed KindaRails2Shell (CVE-2026-66066). It details how crafting a specially formatted MATLAB .mat file, leveraging HDF5 external datasets and ActiveStorage content-type confusion, allows an attacker to trick libvips into reading sensitive files like `/etc/passwd` and ultimately achieve remote code execution. |
| 2026-08-01 2026 | Intigriti Bug Bytes #238 - July 2026 🚀 news 10 min read Bug Bounty Burp Secrets | Survey of AI security challenges, including RAG poisoning and the "lethal trifecta" of AI risks, alongside discussions on reconnaissance for exposure management, exploiting insecure cookie policies, and bypassing Content Security Policy. This entry also highlights the P4RS3LT0NGV3 toolkit for LLM red teaming and the Graphw00f tool for GraphQL endpoint identification. → intigriti.com |
| 2026-07-31 2026 | KindaRails2Shell: arbitrary file read to RCE in Rails Active Storage via libvips (CVE-2026-66066) advanced 3 min read | Writeup on KindaRails2Shell (CVE-2026-66066), a vulnerability in Rails Active Storage utilizing the libvips processor. This flaw allows for arbitrary file reads and potential remote code execution when applications accept untrusted image uploads, particularly affecting Rails 7.x/8.x and certain Rails 6.x configurations. Mitigation involves upgrading Rails and libvips to specific patched versions, setting the `VIPS_BLOCK_UNTRUSTED` environment variable, or calling `Vips.block_untrusted(true)` in an initializer. |
| 2026-07-30 2026 | KindaRails2Shell: CVE-2026-66066 Critical Arbitrary File Read and Possible Remote Code Execution in Ruby on Rails news 3 min read | Writeup of CVE-2026-66066, a critical vulnerability in Ruby on Rails Active Storage and libvips, allows unauthenticated attackers to read application files. Affecting Rails 7.0+ with libvips as the default processor, this CWE-1188 flaw enables potential remote code execution. Remediation requires upgrading Active Storage and libvips to specific versions or applying workarounds like disabling untrusted operations. → rapid7.com |
| 2026-07-30 2026 | Your House Has an FFmpeg Problem - elttam news 8 min read Fuzzing | Writeup detailing an argument injection vulnerability in ffmpeg within Home Assistant. This vulnerability, discovered while searching for attack primitives, allowed for the exfiltration of sensitive files like `/proc/self/environ` by exploiting ffmpeg's pseudo-protocols, including `concat:` and `file:`, to craft synthetic audio headers from binary data. The exploit chain ultimately led to remote code execution by leveraging the exposed `SUPERVISOR_TOKEN`. → elttam.com |
| 2026-07-30 2026 | How I Found a High-Severity Directory Traversal in Flask-Admin intermediate 4 min read Python | Writeup detailing a high-severity directory traversal vulnerability discovered in Flask-Admin. The vulnerability arose from an incorrect filesystem boundary check using `startswith()`, allowing attackers to access files and perform operations outside the configured root directory, impacting download, upload, rename, delete, and directory creation functionalities. The author tested the issue by crafting paths like `../uploads_secret/flag.txt`. → infosecwriteups.com |
| 2026-07-29 2026 | CVE-2026-63077: Critical unauthenticated remote code execution in JetBrains TeamCity news 1 min read | Writeup detailing CVE-2026-63077, a critical unauthenticated remote code execution vulnerability in JetBrains TeamCity. This deserialization flaw allows attackers to execute arbitrary OS commands by exploiting the agent polling protocol. Affected versions require urgent updates to TeamCity 2025.11.7 or 2026.1.3, or application of the security patch plugin for older versions. Network access restriction to TeamCity servers is recommended as a defense-in-depth measure. → rapid7.com |
| 2026-07-29 2026 | Critical CVE-2026-63077: Unauthenticated Remote Code Execution Vulnerability in JetBrains TeamCity On-Premises news 3 min read | Writeup on CVE-2026-63077, an unauthenticated remote code execution vulnerability in JetBrains TeamCity On-Premises. This critical flaw, affecting versions prior to 2025.11.7 and 2026.1.3, allows attackers to execute arbitrary OS commands over HTTP(S) by exploiting the agent polling protocol. While no exploitation is currently reported, immediate upgrades or applying JetBrains' patch plugin are strongly recommended to mitigate this CVSS 9.8 severity vulnerability. → rescana.com |
| 2026-07-29 2026 | Active Exploitation Alert: Critical FastJson CVE-2026-16723 Zero-Day RCE Targeting US Organizations in Spring Boot Applications news 4 min read | Writeup detailing CVE-2026-16723, a critical FastJson zero-day RCE vulnerability actively exploited against US organizations, particularly in Spring Boot applications. This flaw enables arbitrary code execution via malicious JSON payloads exploiting type resolution logic, even with AutoType disabled. Exploitation is widespread, opportunistic, and ongoing, targeting sectors like finance and healthcare. Mitigation involves upgrading FastJson to fastjson2, enabling SafeMode, input validation, and enhanced log monitoring. → rescana.com |
| 2026-07-29 2026 | Simple Job Board ≤ 2.11.0 - Unauthenticated RCE (CVE-2024-1813) news 5 min read | Writeup detailing CVE-2024-1813, an unauthenticated RCE vulnerability in Simple Job Board ≤ 2.11.0. This flaw stems from a double PHP object deserialization, triggered when an administrator views candidate applications. Exploitation requires a vulnerable version, a published job offer, a POP gadget chain from a third-party plugin like All In One SEO (leveraging Monolog), and admin interaction to open the candidate list. The writeup includes techniques to bypass WAFs by altering serialized data syntax. |
| 2026-07-29 2026 | Koollab LMS - Multiple Vulnerabilities including Remote Code Execution SQL Injection and Authentication Bypass news 3 min read | Writeup detailing multiple vulnerabilities in Koollab LMS, including critical remote code execution via unrestricted SCORM and image uploads (CVE-2026-63227, CVE-2026-63228), pre-authentication blind and error-based SQL injection (CVE-2026-63229, CVE-2026-63230), and post-authentication SQL injection (CVE-2026-63231). Further critical flaws include SQL injection combined with unsafe deserialization for RCE (CVE-2026-63232 through CVE-2026-63234), authentication bypass via TOTP and UUID (CVE-2026-63237, CVE-2026-63238), and hard-coded AWS IAM credentials (CVE-2026-63239). |
| 2026-07-29 2026 | The risk hiding behind exposed MCP servers intermediate 6 min read AI | Analysis of exposed Model Context Protocol (MCP) servers reveals widespread vulnerabilities, with approximately 1 in 6 cloud environments exposing unauthenticated servers. These servers, often running older protocol versions predating authentication, grant anonymous callers access to sensitive data, including PII and internal business records. Exploitation can also lead to write/delete operations on production systems, code execution, and even access to cloud credentials via SSRF attacks against metadata endpoints. The inherent self-describing nature of MCP and the ease of generic client communication amplify these risks. → wiz.io |
| 2026-07-29 2026 | The Invisible Hack: How a Linux Bug Lets Anyone Become Root — Without Leaving a Single Trace news 9 min read | Writeup on CVE-2026–31431, a critical Linux kernel vulnerability nicknamed "Copy Fail." This bug allows an unprivileged user to silently elevate to root by exploiting a memory handling flaw in the cryptography module, overwriting the in-memory page cache copy of setuid binaries like `/usr/bin/su` with just two bytes to bypass authentication checks. The exploit is forensically undetectable by conventional means as it leaves no trace on disk or in system logs, and even impacts containerized environments by compromising the shared host kernel memory. → infosecwriteups.com |
| 2026-07-28 2026 | Technical Advisory: wp2shell Unauthenticated Remote Code Execution and Full Site Takeover in WordPress Core news 9 min read | Advisory detailing the wp2shell vulnerability chain in WordPress Core, comprising CVE-2026-63030 (REST API batch endpoint flaw) and CVE-2026-60137 (SQL injection via post query). This chain allows unauthenticated attackers to achieve remote code execution and full site takeover on affected versions (6.9.0-6.9.4, 7.0.0-7.0.1). Active exploitation is confirmed, with a proof-of-concept exploit automating the initial access, including unauthorized administrator account creation and webshell deployment. Patching to 6.9.5 or 7.0.2 is critical, with blocking anonymous access to /wp-json/batch/v1 as a temporary mitigation. |