ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “code execution”

218 stories in the last 30d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 214Exploit / PoC 192Advisory 97Threat actor 87AI safety & security 77Malware 71Industry 35Research 32AI research 26Phishing & fraud 20Model release 18AI industry 16Policy & legal 16Tools 16
SeverityAllcritical 88high 358medium 262low 35info 203

Windows BitLocker Flaw Lets Attackers Execute Code on Vulnerable Systems

Microsoft patched CVE-2026-69449, a heap-based buffer overflow in Windows BitLocker allowing privileged local attackers to execute code; no exploitation reported.

Microsoft disclosed CVE-2026-69449 on September 8, 2026, an Important-severity heap-based buffer overflow (CWE-122) in Windows BitLocker with a CVSS 3.1 base score of 6.7. The attack vector is local (AV:L) with high privileges required, so exploitation needs privileged local access rather than remote access over the internet. Microsoft, as assigned CNA, has not reported public exploitation, and administrators are urged to inventory BitLocker-enabled systems and apply updates. Interim mitigations include least-privilege access, limiting administrative rights, and monitoring for unexpected elevated process activity.

GBHackers · 7d agoVulnerabilityCVE-2026-694491

[webapps] Langflow 1.8.4 - Path Traversal to Remote Code Execution

A path traversal to remote code execution exploit for Langflow 1.8.4, a popular LLM application builder, was published on Exploit-DB.

Exploit-DB lists a proof-of-concept exploit chaining path traversal to remote code execution in Langflow 1.8.4, an open-source tool used to build LLM applications and agents. The chain allows an attacker to write arbitrary files outside the intended directory and achieve code execution on the host. The provided text does not include a CVE identifier or reports of exploitation in the wild, but RCE in a widely deployed AI tooling product is notable for defenders.

Exploit-DB · 16d agoExploit / PoC1

[webapps] FreePBX 17.0.2 - Remote Code Execution (RCE)

Exploit-DB published a remote code execution exploit targeting FreePBX version 17.0.2.

Exploit-DB entry 52681 documents a remote code execution vulnerability in FreePBX 17.0.2, a widely used open-source PBX platform. The listing contains no CVE id, authentication requirement, or evidence of in-the-wild exploitation. FreePBX is commonly internet-facing, so unauthenticated RCE would be significant for exposed deployments.

Exploit-DB · 13d agoExploit / PoC2

[webapps] Metabase 0.61.0 - Authenticated Remote Code Execution

Exploit-DB published an authenticated remote code execution exploit targeting Metabase version 0.61.0.

A new Exploit-DB entry (ID 52680) describes an authenticated remote code execution vulnerability in Metabase 0.61.0. The listing provides minimal detail, but authenticated RCE in a widely deployed BI tool is notable for defenders running exposed instances. No CVE id or in-the-wild exploitation is mentioned in the listing.

Exploit-DB · 13d agoExploit / PoC1

[webapps] Ghost_CMS 6.19.0 - Remote Code Execution

A public proof-of-concept demonstrates remote code execution in Ghost CMS 6.19.0, the widely deployed open-source publishing platform.

Exploit-DB lists a remote code execution proof of concept affecting Ghost CMS version 6.19.0. Ghost is a popular open-source platform used by publishers and blogs worldwide. The listing does not cite a CVE id or report in-the-wild exploitation.

Exploit-DB · 14d agoExploit / PoC1

Unauthenticated PHP Object Injection to Remote Code Execution on GiveWP

Patchstack details an unauthenticated PHP object injection chain enabling remote code execution in the GiveWP WordPress donation plugin.

Patchstack disclosed an unauthenticated remote code execution vulnerability in the GiveWP WordPress donation plugin. An attacker with no account can execute arbitrary commands on the server of an affected GiveWP site. The full chain is reachable when a site has one published donation form and one active payment gateway, a configuration the researcher describes as a common default.

Patchstack · 19d agoVulnerability

Flextype v1.0.0-alpha.3 CMS registerShortcodes() Remote Code Execution via Attacker-Controlled File Inclusion

Flextype CMS v1.0.0-alpha.3 allows PHP remote code execution via path traversal in the Entries API combined with shortcode file inclusion.

Flextype CMS v1.0.0-alpha.3 exposes a remote code execution path through the interaction of the Entries API and Shortcodes::registerShortcodes(). The /api/v1/entries endpoint accepts attacker-controlled entry identifiers containing path traversal sequences, allowing PHP-containing content to be written outside the intended entries directory. A subsequent attacker-controlled path can then be included and executed as PHP. Ron E posted the disclosure to the Full Disclosure mailing list on September 3, 2026.

Full Disclosure · 12d agoVulnerability 8 sources

VU#308749: Remote Code Execution and Arbitrary File Read Vulnerabilities in Kaltura Servers

Insecure deserialization in Kaltura's legacy HTML5 Player V2 (mwEmbed) allows arbitrary file read and remote code execution; Player V7 is unaffected.

CERT/CC issued VU#308749 for two flaws in Kaltura's HTML5 Player V2 library (mwEmbed/html5lib), both caused by the same insecure deserialization bug. The flaws enable arbitrary file read and remote code execution via the exposed mwEmbedLoader.php endpoint. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases; the currently supported Player V7 is unaffected. No evidence of exploitation was cited.

CERT/CC Vulnerability Notes · 21d agoVulnerability

ThreatsDay: Gogs 10.0 RCE, n8n Workflow-to-RCE, $10M Reward, GLM

Hacker News ThreatsDay roundup: Defender BTR.sys driver abuse, DoJ charges 17 Mabna Institute members over IRGC-linked intrusions, Grandoreiro sideloading, OpenAI monitoring.

Check Point researchers showed Microsoft's signed Defender Boot-Time Removal driver (BTR.sys) can be repurposed as a universal kernel operation engine to bypass endpoint security without BYOVD. The DoJ charged 17 members of Iran's Mabna Institute, which on behalf of the IRGC stole over 31 TB of academic data from 144 US universities and compromised roughly 8,000 of 100,000 targeted professor accounts; the State Department offered a $10 million reward for five defendants. Separately, Acronis tracked a Grandoreiro campaign abusing DLL sideloading in the Duplicate Files Finder app across Latin America and Spain, while ErrTraffic ClickFix campaigns deliver Cruciferra (BYOVD) and Remus Stealer. OpenAI also previewed Private Safety Processing, a privacy-centric approach to monitoring model misuse without retaining customer content.

The Hacker News · 26d agoThreat actor1

The Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPT

Check Point discovers cross-account data leakage in ChatGPT: isolated code-execution containers communicate via shared JFrog Artifactory, enabling covert Gmail exfiltration.

Check Point Research found a covert bidirectional channel between ChatGPT code-execution containers belonging to different accounts, which were supposed to be isolated from each other and the public internet. Both could reach the same internal JFrog Artifactory instance used for package delivery, whose exposed Item Management API allowed a 'shared clipboard' between containers. In a proof of concept, a hidden instruction in a shared conversation made ChatGPT retrieve email data from the victim's connected Gmail account and send it to the attacker's account while the victim received a normal answer. The same channel could exfiltrate conversation history and session files; OpenAI recently described a similar isolation weakness in its postmortem of the Hugging Face incident.

Check Point Research · 8d agoAI safety & security1

ZDI-26-594: NVIDIA Megatron Bridge load_model_config Code Injection Remote Code Execution Vulnerability

NVIDIA Megatron Bridge load_model_config code injection flaw (CVE-2026-24251, CVSS 7.8) enables remote arbitrary code execution on affected installs.

ZDI-26-594 describes a code injection vulnerability in NVIDIA Megatron Bridge's load_model_config function, tracked as CVE-2026-24251 with CVSS 7.8. Exploitation allows remote attackers to execute arbitrary code on affected installations and requires user interaction. The advisory was published by the Zero Day Initiative on August 24, 2026.

ZDI Published Advisories · 23d agoAdvisoryCVE-2026-24251

ZDI-26-679: Adobe Photoshop DCM JPEG Image Parsing Integer Overflow Remote Code Execution Vulnerability

ZDI disclosed a CVSS 7.8 integer overflow remote code execution flaw (CVE-2026-75862) in Adobe Photoshop DCM JPEG image parsing.

The Zero Day Initiative published advisory ZDI-26-679 describing an integer overflow remote code execution vulnerability in Adobe Photoshop, tracked as CVE-2026-75862 with a CVSS 7.8 score. The flaw occurs while parsing JPEG data in DCM images. Exploitation requires user interaction: the target must visit a malicious page or open a malicious file. No in-the-wild exploitation is reported.

ZDI Published Advisories · 6d agoVulnerability 3 sourcesCVE-2026-75862

ZDI-26-675: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability

ZDI disclosed a CVSS 7.8 use-after-free remote code execution flaw (CVE-2026-81976) in Adobe Acrobat Reader DC triggered via malicious PDFs.

The Zero Day Initiative published advisory ZDI-26-675 describing a use-after-free remote code execution vulnerability in Adobe Acrobat Reader DC, tracked as CVE-2026-81976 with a CVSS 7.8 score. The flaw resides in the annotation feature. Exploitation requires user interaction: the target must visit a malicious page or open a malicious file. The advisory reports no evidence of in-the-wild exploitation.

ZDI Published Advisories · 6d agoVulnerability 19 sourcesCVE-2026-819761

ZDI-26-648: (Pwn2Own) OpenAI Codex External Control of System or Configuration Setting Remote Code Execution Vulnerability

ZDI published a Pwn2Own advisory for CVE-2026-19590, enabling remote code execution in OpenAI's Codex agent via system or configuration control.

Zero Day Initiative advisory ZDI-26-648 documents an External Control of System or Configuration Setting vulnerability in OpenAI Codex, demonstrated at Pwn2Own. A remote attacker could achieve arbitrary code execution, with user interaction required such as opening malicious content. The flaw is tracked as CVE-2026-19590 with a CVSS rating of 7.8. No exploitation in the wild is reported.

ZDI Published Advisories · 6d agoVulnerability 4 sourcesCVE-2026-195901

ZDI-26-616: Koha Eval Code Injection Remote Code Execution Vulnerability

ZDI disclosed CVE-2026-19780, a CVSS 8.8 authenticated eval code-injection flaw in Koha enabling remote code execution.

Zero Day Initiative advisory ZDI-26-616 describes a code injection vulnerability in the Eval component of Koha, the open-source integrated library system. A remote attacker must authenticate before injecting and executing arbitrary code on affected installations. ZDI assigned the flaw a CVSS 3.0 rating of 8.8.

ZDI Published Advisories · 8d agoVulnerabilityCVE-2026-197801

ZDI-26-604: Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability

Foxit PDF Reader use-after-free flaw (CVE-2026-13126) allows remote code execution when users open malicious files; CVSS 7.8 per ZDI advisory.

ZDI-26-604 describes a use-after-free vulnerability in Foxit PDF Reader's annotation handling, tracked as CVE-2026-13126 and rated CVSS 7.8. Exploitation requires user interaction, with the target visiting a malicious page or opening a malicious file, and allows remote attackers to execute arbitrary code. The advisory was published by the Zero Day Initiative on August 24, 2026.

ZDI Published Advisories · 23d agoAdvisoryCVE-2026-13126

ZDI-26-646: Progress Software Kemp LoadMaster escape_quotes Uninitialized Memory Remote Code Execution Vulnerability

ZDI publishes ZDI-26-646 for CVE-2026-8037, an authenticated uninitialized-memory remote code execution flaw in Progress Kemp LoadMaster, rated CVSS 7.2.

Zero Day Initiative published advisory ZDI-26-646 describing an uninitialized memory flaw in Progress Software Kemp LoadMaster's escape_quotes function. Successful exploitation allows remote authenticated attackers to execute arbitrary code on affected installations. ZDI rated the issue CVSS 7.2 and assigned CVE-2026-8037.

ZDI Published Advisories · 7d agoAdvisoryCVE-2026-8037

ZDI-26-598: Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability

Foxit PDF Reader AcroForm use-after-free (CVE-2026-57242, CVSS 7.8) permits remote code execution through malicious PDF files or pages.

ZDI-26-598 details a use-after-free in the AcroForm component of Foxit PDF Reader, tracked as CVE-2026-57242 and rated CVSS 7.8. A remote attacker can execute arbitrary code if the target opens a malicious file or visits a malicious page. The advisory was published by the Zero Day Initiative on August 24, 2026.

ZDI Published Advisories · 23d agoAdvisoryCVE-2026-57242

ZDI-26-633: GIMP PSP File Parsing Integer Overflow Remote Code Execution Vulnerability

ZDI disclosed a CVSS 7.8 integer overflow in GIMP's PSP file parser that enables remote code execution when users open malicious files.

ZDI published advisory ZDI-26-633 for an integer overflow in GIMP's parsing of PSP image files. Remote attackers can execute arbitrary code, but exploitation requires user interaction such as opening a malicious file. ZDI assigned CVSS 7.8 and the issue is tracked as CVE-2026-4153.

ZDI Published Advisories · 7d agoAdvisoryCVE-2026-41531

ZDI-26-635: Oracle Outside In Technology PDF File Parsing Integer Overflow Remote Code Execution Vulnerability

ZDI disclosed CVE-2026-60392, an integer overflow in Oracle Outside In PDF parsing enabling remote code execution, rated CVSS 7.8.

The Zero Day Initiative published advisory ZDI-26-635 describing an integer overflow vulnerability in PDF file parsing within Oracle Outside In Technology. Successful exploitation allows remote code execution but requires user interaction, such as opening a malicious file or visiting a malicious page. ZDI assigned the flaw a CVSS rating of 7.8.

ZDI Published Advisories · 7d agoAdvisory 4 sourcesCVE-2026-603921

ZDI-26-592: NVIDIA TensorRT ONNX File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability

NVIDIA TensorRT improper array index validation in ONNX parsing (CVE-2026-24238, CVSS 7.8) enables remote code execution.

ZDI-26-592 addresses improper validation of array index in NVIDIA TensorRT's ONNX file parsing, tracked as CVE-2026-24238 with CVSS 7.8. Exploitation permits remote code execution on affected installations and requires user interaction. The advisory was published by the Zero Day Initiative on August 24, 2026.

ZDI Published Advisories · 23d agoAdvisoryCVE-2026-24238

ZDI-26-602: Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution Vulnerability

ZDI disclosed a use-after-free in Foxit PDF Reader (CVE-2026-13128) enabling remote code execution when a user opens a malicious file.

Zero Day Initiative advisory ZDI-26-602 describes a use-after-free flaw in Foxit PDF Reader's document object handling. Exploitation yields arbitrary code execution but requires the target to open a malicious page or file. ZDI assigned CVSS 7.8 and CVE-2026-13128. The advisory does not report active exploitation.

ZDI Published Advisories · 23d agoVulnerabilityCVE-2026-13128

ZDI-26-595: Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability

Foxit PDF Reader has a use-after-free vulnerability (CVE-2026-57254, CVSS 7.8) allowing remote code execution when a user opens a malicious file or page.

ZDI-26-595 describes a use-after-free vulnerability in the annotation feature of Foxit PDF Reader, tracked as CVE-2026-57254 with a CVSS score of 7.8. Successful exploitation allows remote attackers to execute arbitrary code, but requires user interaction such as visiting a malicious page or opening a malicious file. The advisory does not mention any exploitation in the wild.

ZDI Published Advisories · 23d agoVulnerabilityCVE-2026-57254

ZDI-26-597: Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability

Foxit PDF Reader has a use-after-free vulnerability (CVE-2026-57252, CVSS 7.8) allowing remote code execution via malicious AcroForm content.

ZDI-26-597 describes a use-after-free vulnerability in the AcroForm feature of Foxit PDF Reader, tracked as CVE-2026-57252 with a CVSS score of 7.8. Successful exploitation allows remote attackers to execute arbitrary code, but requires user interaction such as visiting a malicious page or opening a malicious file. The advisory does not mention any exploitation in the wild.

ZDI Published Advisories · 23d agoVulnerabilityCVE-2026-57252

ZDI-26-613: (0Day) pdfforge PDF Architect PDF File Parsing Memory Corruption Remote Code Execution Vulnerability

ZDI published ZDI-26-613, an unpatched memory corruption flaw in pdfforge PDF Architect PDF parsing enabling remote code execution (CVSS 7.8).

The Zero Day Initiative disclosed ZDI-26-613, a memory corruption vulnerability in pdfforge PDF Architect's PDF file parsing that allows remote code execution on affected installations. User interaction is required, meaning the target must visit a malicious page or open a malicious file. ZDI assigned a CVSS score of 7.8 and classifies the issue as a 0day.

ZDI Published Advisories · 16d agoAdvisory

ZDI-26-603: Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability

Foxit PDF Reader has a second annotation use-after-free vulnerability (CVE-2026-13127, CVSS 7.8) allowing remote code execution via malicious files or pages.

ZDI-26-603 describes a use-after-free vulnerability in the annotation feature of Foxit PDF Reader, tracked as CVE-2026-13127 with a CVSS score of 7.8. Successful exploitation allows remote attackers to execute arbitrary code, but requires user interaction such as visiting a malicious page or opening a malicious file. The advisory does not mention any exploitation in the wild.

ZDI Published Advisories · 23d agoVulnerabilityCVE-2026-13127

ZDI-26-622: Microsoft Windows IKEv2 AES-GCM Decryption Integer Underflow Remote Code Execution Vulnerability

ZDI disclosed CVE-2026-50696, a CVSS 8.1 integer underflow in Windows IKEv2 AES-GCM decryption enabling unauthenticated remote code execution on specific IPsec configurations.

The Zero Day Initiative published ZDI-26-622 describing a remote code execution vulnerability in Microsoft Windows' IKEv2 AES-GCM decryption path, caused by an integer underflow. Authentication is not required for exploitation, but only systems using specific IPsec configurations are affected. ZDI assigned the vulnerability a CVSS score of 8.1 and the identifier CVE-2026-50696.

ZDI Published Advisories · 8d agoAdvisoryCVE-2026-506961

ZDI-26-611: (0Day) pdfforge PDF Architect App Object Out-Of-Bounds Read Remote Code Execution Vulnerability

ZDI published ZDI-26-611, an unpatched out-of-bounds read in pdfforge PDF Architect App Object enabling remote code execution (CVSS 7.8).

The Zero Day Initiative disclosed ZDI-26-611, an out-of-bounds read vulnerability in the App Object component of pdfforge PDF Architect that can lead to remote code execution. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file. ZDI rated the issue 7.8 on the CVSS scale and marks it as a 0day pending a vendor patch.

ZDI Published Advisories · 16d agoAdvisory

ZDI-26-612: (0Day) pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

ZDI published ZDI-26-612, an unpatched out-of-bounds write in pdfforge PDF Architect PDF parsing enabling remote code execution (CVSS 7.8).

The Zero Day Initiative disclosed ZDI-26-612, an out-of-bounds write vulnerability in pdfforge PDF Architect's PDF file parsing. Successful exploitation allows remote code execution on affected installations. User interaction is required, as the target must visit a malicious page or open a malicious file; ZDI assigned a CVSS score of 7.8 and lists the flaw as a 0day.

ZDI Published Advisories · 16d agoAdvisory

ZDI-26-614: (0Day) pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

ZDI published ZDI-26-614, another unpatched out-of-bounds write in pdfforge PDF Architect PDF parsing enabling remote code execution (CVSS 7.8).

The Zero Day Initiative published ZDI-26-614, a second out-of-bounds write vulnerability in pdfforge PDF Architect's PDF file parsing. Attackers can execute arbitrary code on affected installations, provided the user visits a malicious page or opens a malicious file. The flaw carries a ZDI-assigned CVSS score of 7.8 and remains unpatched (0day).

ZDI Published Advisories · 16d agoAdvisory

ZDI-26-589: BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability

ZDI details a network-adjacent stack buffer overflow in BlueZ's A2DP stack (CVE-2026-19774, CVSS 7.1) allowing remote code execution after pairing a malicious Bluetooth device.

The Zero Day Initiative published advisory ZDI-26-589 for a stack-based buffer overflow in BlueZ, the Linux Bluetooth protocol stack. A network-adjacent attacker who can pair a malicious Bluetooth device with the target can execute arbitrary code on the affected installation. The flaw carries a CVSS 7.1 rating and is tracked as CVE-2026-19774.

ZDI Published Advisories · 23d agoAdvisoryCVE-2026-19774

ZDI-26-692: Linux Kernel eMPIA USB Device Driver Race Condition Code Execution Vulnerability

ZDI-26-692: race condition in Linux kernel eMPIA USB driver (CVE-2026-31583) lets physically present attackers execute code without authentication; CVSS 7.1.

ZDI advisory ZDI-26-692 discloses a race condition in the Linux kernel's eMPIA USB device driver that allows physically present attackers to execute arbitrary code on affected installations. Authentication is not required, but physical access to the target system is necessary. ZDI assigned a CVSS rating of 7.1 and CVE-2026-31583.

ZDI Published Advisories · 2d agoVulnerabilityCVE-2026-31583

Windows BitLocker Vulnerability Allows Attackers to Execute Malicious Code Remotely

Microsoft patched CVE-2026-69449, a heap-based buffer overflow in Windows BitLocker enabling code execution, affecting Windows 10/11 and Server 2012-2025 in September 2026 updates.

Microsoft disclosed CVE-2026-69449, a heap-based buffer overflow in Windows BitLocker rated Important, which could allow an authorized attacker to execute arbitrary code locally, with possible in-network exploitation via arbitrary endpoint calls. Microsoft rates exploitation as Less Likely and there was no public disclosure or in-the-wild exploitation at release. The flaw affects Windows 10 (1607-22H2), Windows 11 (23H2-26H1), and Windows Server 2012 through 2025, including Server Core. Fixes shipped in the September 2026 Patch Tuesday cumulative updates via platform-specific KBs such as KB5124012 and KB5122871.

Cyber Security News · 7d agoVulnerabilityCVE-2026-694491

Home & Small Office Wireless Routers Exploited to Attack Gaming Servers

Unit 42 details an updated Gafgyt botnet variant exploiting Zyxel, Huawei, and Realtek router vulnerabilities to recruit devices for DoS attacks on gaming servers.

Unit 42 researchers identified an updated Gafgyt variant derived from the JenX botnet that combines three remote code execution exploits: CVE-2017-18368 (Zyxel P660HN-T1A), CVE-2017-17215 (Huawei HG532), and CVE-2014-8361 (Realtek RTL81XX chipset). Shodan scans show more than 32,000 wireless routers worldwide potentially vulnerable to these exploits. The exploits act as droppers, pulling architecture-specific binaries from a malicious server (185.172.110.224), and the botnet performs denial-of-service attacks against gaming servers, most notably Valve Source engine servers.

Palo Alto Unit 42 · 29d agoMalware in the wildCVE-2017-18368CVE-2017-17215CVE-2014-83611

Amazon Kiro Prompt Injection Can Exfiltrate Sensitive Data Through Kiro Powers

Mindgard found a prompt injection flaw in Amazon Kiro IDE letting attacker-controlled workspace files exfiltrate sensitive local data; fixed in version 0.8.140.

Mindgard disclosed a prompt injection flaw in Amazon Kiro, an agentic AI IDE, that lets attacker-controlled repository content steer the agent into exfiltrating sensitive workspace data through Kiro Powers, which bundles MCP server configurations, POWER.md steering files, hooks, and contextual knowledge. Exploitation requires the user to open a malicious project via a workspace file and send any message to the agent; difficulty is rated low and it works in both trusted and untrusted workspaces. Amazon fixed the issue in Kiro IDE 0.8.140; the flaw has no CVE identifier and follows earlier Kiro bugs including CVE-2026-10591, plus related prompt-injection and code-execution issues in Codex CLI, Cursor, Gemini CLI, Copilot CLI, and Claude Code.

The Hacker News · 18d agoAI safety & securityCVE-2026-10591CVE-2026-35603CVE-2026-257251

ZDI-26-645: Fortinet FortiSandbox write_remote_backup_to_crontab cronValue Command Injection Remote Code Execution Vulnerability

ZDI publishes ZDI-26-645 for CVE-2026-84387, an authenticated command injection RCE in Fortinet FortiSandbox via crontab backup, rated CVSS 7.2.

Zero Day Initiative published advisory ZDI-26-645 describing a command injection flaw in Fortinet FortiSandbox's write_remote_backup_to_crontab function. Remote authenticated attackers can execute arbitrary code through the cronValue parameter. ZDI rated the issue CVSS 7.2 and assigned CVE-2026-84387.

ZDI Published Advisories · 7d agoAdvisoryCVE-2026-84387

ZDI-26-586: OriginLab Origin Viewer OGM File Parsing Memory Corruption Remote Code Execution Vulnerability

ZDI advisory ZDI-26-586 reports a memory corruption RCE (CVE-2026-19886, CVSS 7.8) in OriginLab Origin Viewer OGM file parsing, needing user interaction.

The Zero Day Initiative published advisory ZDI-26-586 describing a memory corruption vulnerability in OriginLab Origin Viewer's OGM file parsing. Exploitation allows remote code execution when a user opens a malicious file or visits a crafted page. ZDI rated the issue CVSS 7.8 and assigned CVE-2026-19886.

ZDI Published Advisories · 23d agoAdvisoryCVE-2026-19886

ZDI-26-587: Ashlar-Vellum Cobalt VS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

ZDI advisory ZDI-26-587 details a heap-based buffer overflow RCE (CVE-2026-19781, CVSS 7.8) in Ashlar-Vellum Cobalt VS file parsing, requiring user interaction.

The Zero Day Initiative released advisory ZDI-26-587 covering a heap-based buffer overflow in Ashlar-Vellum Cobalt's VS file parsing. A remote attacker can execute arbitrary code when the target opens a malicious file or visits a crafted page. ZDI rated the vulnerability CVSS 7.8 and assigned CVE-2026-19781.

ZDI Published Advisories · 23d agoAdvisoryCVE-2026-19781

ZDI-26-591: NVIDIA TensorRT ONNX File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

ZDI disclosed a heap-based buffer overflow RCE (CVE-2026-24272, CVSS 7.8) in NVIDIA TensorRT ONNX parsing, requiring user interaction to exploit.

The Zero Day Initiative published advisory ZDI-26-591 covering a heap-based buffer overflow in NVIDIA TensorRT's ONNX file parsing. Successful exploitation allows remote code execution when a user opens a malicious ONNX file or visits a crafted page. ZDI rated the vulnerability CVSS 7.8 and assigned CVE-2026-24272.

ZDI Published Advisories · 23d agoAdvisoryCVE-2026-24272

ZDI-26-593: NVIDIA TensorRT ONNX File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

ZDI disclosed a second TensorRT heap-based buffer overflow RCE (CVE-2026-24268, CVSS 7.8) in ONNX file parsing, requiring user interaction.

The Zero Day Initiative published advisory ZDI-26-593 covering another heap-based buffer overflow in NVIDIA TensorRT's ONNX file parsing. A remote attacker can execute arbitrary code if the target opens a malicious file or visits a crafted page. ZDI rated the vulnerability CVSS 7.8 and assigned CVE-2026-24268.

ZDI Published Advisories · 23d agoAdvisoryCVE-2026-24268