Search: “remote code execution”

1,321 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 4236 Malware 2029 Exploit / PoC 1999 Ransomware 1094 Threat actor 441 Data breach 254 Advisory 132 Phishing & fraud 87 AI safety & security 57 Policy & legal 53 Industry 48 Research 24 AI tools & infra 13 Tools 11

SeverityAll critical 5725 high 3265 medium 1346 low 78 info 78

IoT Under Siege: The Anatomy of the Latest Mirai Campaign Leveraging Multiple IoT Exploits

Unit 42 tracks a Mirai botnet campaign exploiting over 20 IoT vulnerabilities in routers, cameras and DVRs to build DDoS botnets since March 2023.

Since March 2023, Unit 42 has tracked threat actors exploiting more than 20 IoT vulnerabilities to spread a Mirai botnet variant, first seen downloading payloads from zvub.us on March 14, 2023. Exploited flaws span CVE-2023-1389 (TP-Link Archer), CVE-2022-30525 (Zyxel), CVE-2022-31499 (Nortek) and many router, camera and DVR bugs. The variant decrypts configuration strings with an XOR key derived from 0xDEADBEEF and lacks built-in credential brute forcing, so spreading relies on manual operator exploitation. Two campaigns observed since October 2022 share infrastructure and near-identical samples.

Palo Alto Unit 42Aug 17, 13:04 UTC · Aug 17, 2026Malware in the wildCVE-2019-12725 CVE-2019-17621 CVE-2019-20500+13 CVEs1

[remote] ipTIME A3004T - Remote Code Execution

A remote code execution exploit was published for ipTIME A3004T routers, a flaw relevant to internet-facing devices.

Exploit-DB published exploit #52644 for the ipTIME A3004T router, demonstrating remote code execution. Router RCE flaws are typically exploitable by unauthenticated attackers on exposed devices. The disclosure text does not report exploitation in the wild.

Exploit-DBAug 17, 00:00 UTC · Aug 17, 2026Exploit / PoC

[webapps] Joomla JCE_2.9.15 - Remote Code Execution

A remote code execution proof of concept for Joomla Content Editor (JCE) 2.9.15 was published on Exploit-DB.

Exploit-DB added a webapps proof-of-concept for remote code execution affecting the Joomla Content Editor (JCE) component version 2.9.15. JCE is a widely deployed editor extension used on Joomla websites. The entry provides no CVE id and no evidence of in-the-wild exploitation.

Exploit-DBAug 17, 00:00 UTC · Aug 17, 2026Exploit / PoC1

[webapps] Langflow 1.8.4 - Path Traversal to Remote Code Execution

A path traversal to remote code execution exploit for Langflow 1.8.4, a popular LLM application builder, was published on Exploit-DB.

Exploit-DB lists a proof-of-concept exploit chaining path traversal to remote code execution in Langflow 1.8.4, an open-source tool used to build LLM applications and agents. The chain allows an attacker to write arbitrary files outside the intended directory and achieve code execution on the host. The provided text does not include a CVE identifier or reports of exploitation in the wild, but RCE in a widely deployed AI tooling product is notable for defenders.

Exploit-DBAug 31, 00:00 UTC · 16d agoExploit / PoC1

[webapps] FreePBX 17.0.2 - Remote Code Execution (RCE)

Exploit-DB published a remote code execution exploit targeting FreePBX version 17.0.2.

Exploit-DB entry 52681 documents a remote code execution vulnerability in FreePBX 17.0.2, a widely used open-source PBX platform. The listing contains no CVE id, authentication requirement, or evidence of in-the-wild exploitation. FreePBX is commonly internet-facing, so unauthenticated RCE would be significant for exposed deployments.

Exploit-DBSep 3, 00:00 UTC · 13d agoExploit / PoC2

[webapps] Metabase 0.61.0 - Authenticated Remote Code Execution

Exploit-DB published an authenticated remote code execution exploit targeting Metabase version 0.61.0.

A new Exploit-DB entry (ID 52680) describes an authenticated remote code execution vulnerability in Metabase 0.61.0. The listing provides minimal detail, but authenticated RCE in a widely deployed BI tool is notable for defenders running exposed instances. No CVE id or in-the-wild exploitation is mentioned in the listing.

Exploit-DBSep 3, 00:00 UTC · 13d agoExploit / PoC1

Mirai Variant MooBot Targeting D

Unit 42 observed the MooBot Mirai variant exploiting four D-Link vulnerabilities to compromise unpatched routers for use in DDoS attacks.

Unit 42 captured attacks exploiting four D-Link remote code execution vulnerabilities: CVE-2015-2051, CVE-2018-6530, CVE-2022-26258, and CVE-2022-28958, with three rated critical at CVSS 9.8. The exploits download the MooBot malware, a Mirai botnet variant, from infrastructure at 159.203.15.179 via wget. Compromised devices fall under full attacker control and can be used for distributed denial-of-service attacks. D-Link has published bulletins for all four flaws, but unpatched devices remain exposed.

Palo Alto Unit 42Aug 17, 13:06 UTC · Aug 17, 2026Malware in the wildCVE-2015-2051 CVE-2018-6530 CVE-2022-26258+1 CVEs

Old Wine in the New Bottle: Mirai Variant Targets Multiple IoT Devices

Unit 42 analyzed the Mirai IZ1H9 botnet variant exploiting Tenda, LB-Link, DCN and Zyxel flaws to build DDoS-capable IoT botnets.

Unit 42 observed the Mirai IZ1H9 variant on April 10, 2023, using a shell script downloader lb.sh from 163.123.143.126 to infect exposed Linux servers and networking devices. Campaigns running since November 2021 share infrastructure, near-identical bot functions and the XOR key 0xBAADF00D. The malware exploits CVE-2023-27076 (Tenda G103), CVE-2023-26801 (LB-Link), CVE-2023-26802 (DCN DCBI-Netlog-LAB) and a Zyxel RCE flaw. Compromised devices join a botnet used for DDoS attacks, and the downloader deletes logs and modifies iptables to block SSH, Telnet and HTTP recovery.

Palo Alto Unit 42Aug 17, 13:04 UTC · Aug 17, 2026Malware in the wildCVE-2023-27076 CVE-2023-26801 CVE-2023-26802

[webapps] Ghost_CMS 6.19.0 - Remote Code Execution

A public proof-of-concept demonstrates remote code execution in Ghost CMS 6.19.0, the widely deployed open-source publishing platform.

Exploit-DB lists a remote code execution proof of concept affecting Ghost CMS version 6.19.0. Ghost is a popular open-source platform used by publishers and blogs worldwide. The listing does not cite a CVE id or report in-the-wild exploitation.

Exploit-DBSep 2, 00:00 UTC · 14d agoExploit / PoC1

Unauthenticated PHP Object Injection to Remote Code Execution on GiveWP

Patchstack details an unauthenticated PHP object injection chain enabling remote code execution in the GiveWP WordPress donation plugin.

Patchstack disclosed an unauthenticated remote code execution vulnerability in the GiveWP WordPress donation plugin. An attacker with no account can execute arbitrary commands on the server of an affected GiveWP site. The full chain is reachable when a site has one published donation form and one active payment gateway, a configuration the researcher describes as a common default.

PatchstackAug 28, 09:39 UTC · 19d agoVulnerability

Flextype v1.0.0-alpha.3 CMS registerShortcodes() Remote Code Execution via Attacker-Controlled File Inclusion

Flextype CMS v1.0.0-alpha.3 allows PHP remote code execution via path traversal in the Entries API combined with shortcode file inclusion.

Flextype CMS v1.0.0-alpha.3 exposes a remote code execution path through the interaction of the Entries API and Shortcodes::registerShortcodes(). The /api/v1/entries endpoint accepts attacker-controlled entry identifiers containing path traversal sequences, allowing PHP-containing content to be written outside the intended entries directory. A subsequent attacker-controlled path can then be included and executed as PHP. Ron E posted the disclosure to the Full Disclosure mailing list on September 3, 2026.

Full DisclosureSep 4, 00:13 UTC · 12d agoVulnerability 8 sources

VU#308749: Remote Code Execution and Arbitrary File Read Vulnerabilities in Kaltura Servers

Insecure deserialization in Kaltura's legacy HTML5 Player V2 (mwEmbed) allows arbitrary file read and remote code execution; Player V7 is unaffected.

CERT/CC issued VU#308749 for two flaws in Kaltura's HTML5 Player V2 library (mwEmbed/html5lib), both caused by the same insecure deserialization bug. The flaws enable arbitrary file read and remote code execution via the exposed mwEmbedLoader.php endpoint. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases; the currently supported Player V7 is unaffected. No evidence of exploitation was cited.

CERT/CC Vulnerability NotesAug 25, 16:11 UTC · 21d agoVulnerability

ZDI-26-679: Adobe Photoshop DCM JPEG Image Parsing Integer Overflow Remote Code Execution Vulnerability

ZDI disclosed a CVSS 7.8 integer overflow remote code execution flaw (CVE-2026-75862) in Adobe Photoshop DCM JPEG image parsing.

The Zero Day Initiative published advisory ZDI-26-679 describing an integer overflow remote code execution vulnerability in Adobe Photoshop, tracked as CVE-2026-75862 with a CVSS 7.8 score. The flaw occurs while parsing JPEG data in DCM images. Exploitation requires user interaction: the target must visit a malicious page or open a malicious file. No in-the-wild exploitation is reported.

ZDI Published AdvisoriesSep 10, 05:00 UTC · 6d agoVulnerability 3 sources CVE-2026-75862

ZDI-26-592: NVIDIA TensorRT ONNX File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability

NVIDIA TensorRT improper array index validation in ONNX parsing (CVE-2026-24238, CVSS 7.8) enables remote code execution.

ZDI-26-592 addresses improper validation of array index in NVIDIA TensorRT's ONNX file parsing, tracked as CVE-2026-24238 with CVSS 7.8. Exploitation permits remote code execution on affected installations and requires user interaction. The advisory was published by the Zero Day Initiative on August 24, 2026.

ZDI Published AdvisoriesAug 24, 05:00 UTC · 23d agoAdvisory CVE-2026-24238

ZDI-26-578: NGINX HTTP Dav Module Alias Directive Integer Underflow Remote Code Execution Vulnerability

An unauthenticated integer underflow (CVE-2026-27654, CVSS 8.1) in NGINX's HTTP Dav module alias directive enables remote code execution.

ZDI advisory ZDI-26-578 describes an integer underflow in the alias directive of the NGINX HTTP Dav module that allows remote attackers to execute arbitrary code. Authentication is not required to exploit the vulnerability. ZDI rated the issue 8.1 on CVSS and assigned CVE-2026-27654.

ZDI Published AdvisoriesAug 13, 05:00 UTC · Aug 13, 2026Vulnerability CVE-2026-27654

ZDI-26-566: BlackBerry QNX KEV File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

ZDI disclosed an out-of-bounds write flaw (CVE-2026-40272) in BlackBerry QNX KEV file parsing enabling remote code execution.

The Zero Day Initiative published ZDI-26-566 describing an out-of-bounds write vulnerability in BlackBerry QNX KEV file parsing. Remote code execution requires user interaction, such as visiting a malicious page or opening a malicious file. ZDI assigned a CVSS score of 7.8 and the CVE identifier CVE-2026-40272.

ZDI Published AdvisoriesAug 13, 05:00 UTC · Aug 13, 2026Vulnerability CVE-2026-40272

ZDI-26-675: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability

ZDI disclosed a CVSS 7.8 use-after-free remote code execution flaw (CVE-2026-81976) in Adobe Acrobat Reader DC triggered via malicious PDFs.

The Zero Day Initiative published advisory ZDI-26-675 describing a use-after-free remote code execution vulnerability in Adobe Acrobat Reader DC, tracked as CVE-2026-81976 with a CVSS 7.8 score. The flaw resides in the annotation feature. Exploitation requires user interaction: the target must visit a malicious page or open a malicious file. The advisory reports no evidence of in-the-wild exploitation.

ZDI Published AdvisoriesSep 10, 05:00 UTC · 6d agoVulnerability 19 sources CVE-2026-819761

ZDI-26-648: (Pwn2Own) OpenAI Codex External Control of System or Configuration Setting Remote Code Execution Vulnerability

ZDI published a Pwn2Own advisory for CVE-2026-19590, enabling remote code execution in OpenAI's Codex agent via system or configuration control.

Zero Day Initiative advisory ZDI-26-648 documents an External Control of System or Configuration Setting vulnerability in OpenAI Codex, demonstrated at Pwn2Own. A remote attacker could achieve arbitrary code execution, with user interaction required such as opening malicious content. The flaw is tracked as CVE-2026-19590 with a CVSS rating of 7.8. No exploitation in the wild is reported.

ZDI Published AdvisoriesSep 10, 05:00 UTC · 6d agoVulnerability 4 sources CVE-2026-195901

ZDI-26-579: Cisco Identity Services Engine zipFiles Directory Traversal Remote Code Execution Vulnerability

ZDI disclosed an authenticated directory traversal flaw (CVE-2026-20181) in Cisco Identity Services Engine allowing remote code execution, CVSS 7.2.

The Zero Day Initiative published ZDI-26-579 describing a directory traversal in the zipFiles functionality of Cisco Identity Services Engine. Authenticated remote attackers can execute arbitrary code on affected installations. ZDI assigned a CVSS score of 7.2 and the identifier CVE-2026-20181.

ZDI Published AdvisoriesAug 13, 05:00 UTC · Aug 13, 2026Vulnerability CVE-2026-20181

ZDI-26-635: Oracle Outside In Technology PDF File Parsing Integer Overflow Remote Code Execution Vulnerability

ZDI disclosed CVE-2026-60392, an integer overflow in Oracle Outside In PDF parsing enabling remote code execution, rated CVSS 7.8.

The Zero Day Initiative published advisory ZDI-26-635 describing an integer overflow vulnerability in PDF file parsing within Oracle Outside In Technology. Successful exploitation allows remote code execution but requires user interaction, such as opening a malicious file or visiting a malicious page. ZDI assigned the flaw a CVSS rating of 7.8.

ZDI Published AdvisoriesSep 9, 05:00 UTC · 7d agoAdvisory 4 sources CVE-2026-603921

ZDI-26-581: Cisco Identity Services Engine invokeScript Command Injection Remote Code Execution Vulnerability

ZDI details CVE-2026-20147, an authenticated command injection in Cisco Identity Services Engine allowing remote code execution, rated CVSS 7.2.

ZDI-26-581 describes a command injection flaw in Cisco Identity Services Engine reachable through the invokeScript function. Remote attackers who authenticate can execute arbitrary code on affected installations. The issue is tracked as CVE-2026-20147 and carries a CVSS rating of 7.2. No exploitation activity is reported in the advisory.

ZDI Published AdvisoriesAug 13, 05:00 UTC · Aug 13, 2026Vulnerability CVE-2026-20147

ZDI-26-613: (0Day) pdfforge PDF Architect PDF File Parsing Memory Corruption Remote Code Execution Vulnerability

ZDI published ZDI-26-613, an unpatched memory corruption flaw in pdfforge PDF Architect PDF parsing enabling remote code execution (CVSS 7.8).

The Zero Day Initiative disclosed ZDI-26-613, a memory corruption vulnerability in pdfforge PDF Architect's PDF file parsing that allows remote code execution on affected installations. User interaction is required, meaning the target must visit a malicious page or open a malicious file. ZDI assigned a CVSS score of 7.8 and classifies the issue as a 0day.

ZDI Published AdvisoriesAug 31, 05:00 UTC · 16d agoAdvisory

ZDI-26-611: (0Day) pdfforge PDF Architect App Object Out-Of-Bounds Read Remote Code Execution Vulnerability

ZDI published ZDI-26-611, an unpatched out-of-bounds read in pdfforge PDF Architect App Object enabling remote code execution (CVSS 7.8).

The Zero Day Initiative disclosed ZDI-26-611, an out-of-bounds read vulnerability in the App Object component of pdfforge PDF Architect that can lead to remote code execution. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file. ZDI rated the issue 7.8 on the CVSS scale and marks it as a 0day pending a vendor patch.

ZDI Published AdvisoriesAug 31, 05:00 UTC · 16d agoAdvisory

ZDI-26-614: (0Day) pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

ZDI published ZDI-26-614, another unpatched out-of-bounds write in pdfforge PDF Architect PDF parsing enabling remote code execution (CVSS 7.8).

The Zero Day Initiative published ZDI-26-614, a second out-of-bounds write vulnerability in pdfforge PDF Architect's PDF file parsing. Attackers can execute arbitrary code on affected installations, provided the user visits a malicious page or opens a malicious file. The flaw carries a ZDI-assigned CVSS score of 7.8 and remains unpatched (0day).

ZDI Published AdvisoriesAug 31, 05:00 UTC · 16d agoAdvisory

ZDI-26-612: (0Day) pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

ZDI published ZDI-26-612, an unpatched out-of-bounds write in pdfforge PDF Architect PDF parsing enabling remote code execution (CVSS 7.8).

The Zero Day Initiative disclosed ZDI-26-612, an out-of-bounds write vulnerability in pdfforge PDF Architect's PDF file parsing. Successful exploitation allows remote code execution on affected installations. User interaction is required, as the target must visit a malicious page or open a malicious file; ZDI assigned a CVSS score of 7.8 and lists the flaw as a 0day.

ZDI Published AdvisoriesAug 31, 05:00 UTC · 16d agoAdvisory

ZDI-26-604: Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability

Foxit PDF Reader use-after-free flaw (CVE-2026-13126) allows remote code execution when users open malicious files; CVSS 7.8 per ZDI advisory.

ZDI-26-604 describes a use-after-free vulnerability in Foxit PDF Reader's annotation handling, tracked as CVE-2026-13126 and rated CVSS 7.8. Exploitation requires user interaction, with the target visiting a malicious page or opening a malicious file, and allows remote attackers to execute arbitrary code. The advisory was published by the Zero Day Initiative on August 24, 2026.

ZDI Published AdvisoriesAug 24, 05:00 UTC · 23d agoAdvisory CVE-2026-13126

ZDI-26-598: Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability

Foxit PDF Reader AcroForm use-after-free (CVE-2026-57242, CVSS 7.8) permits remote code execution through malicious PDF files or pages.

ZDI-26-598 details a use-after-free in the AcroForm component of Foxit PDF Reader, tracked as CVE-2026-57242 and rated CVSS 7.8. A remote attacker can execute arbitrary code if the target opens a malicious file or visits a malicious page. The advisory was published by the Zero Day Initiative on August 24, 2026.

ZDI Published AdvisoriesAug 24, 05:00 UTC · 23d agoAdvisory CVE-2026-57242

ZDI-26-616: Koha Eval Code Injection Remote Code Execution Vulnerability

ZDI disclosed CVE-2026-19780, a CVSS 8.8 authenticated eval code-injection flaw in Koha enabling remote code execution.

Zero Day Initiative advisory ZDI-26-616 describes a code injection vulnerability in the Eval component of Koha, the open-source integrated library system. A remote attacker must authenticate before injecting and executing arbitrary code on affected installations. ZDI assigned the flaw a CVSS 3.0 rating of 8.8.

ZDI Published AdvisoriesSep 8, 05:00 UTC · 8d agoVulnerability CVE-2026-197801

ZDI-26-550: OriginLab OriginPro OGW File Parsing Memory Corruption Remote Code Execution Vulnerability

ZDI discloses a memory corruption flaw in OriginLab OriginPro OGW file parsing enabling remote code execution via malicious files (CVE-2026-18291, CVSS 7.8).

ZDI advisory ZDI-26-550 describes a memory corruption vulnerability in OriginLab OriginPro OGW file parsing that allows remote attackers to execute arbitrary code. User interaction is required: the target must visit a malicious page or open a malicious file. The flaw has a CVSS rating of 7.8 and is assigned CVE-2026-18291.

ZDI Published AdvisoriesAug 11, 05:00 UTC · Aug 11, 2026Vulnerability CVE-2026-18291

ZDI-26-597: Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability

Foxit PDF Reader has a use-after-free vulnerability (CVE-2026-57252, CVSS 7.8) allowing remote code execution via malicious AcroForm content.

ZDI-26-597 describes a use-after-free vulnerability in the AcroForm feature of Foxit PDF Reader, tracked as CVE-2026-57252 with a CVSS score of 7.8. Successful exploitation allows remote attackers to execute arbitrary code, but requires user interaction such as visiting a malicious page or opening a malicious file. The advisory does not mention any exploitation in the wild.

ZDI Published AdvisoriesAug 24, 05:00 UTC · 23d agoVulnerability CVE-2026-57252

ZDI-26-633: GIMP PSP File Parsing Integer Overflow Remote Code Execution Vulnerability

ZDI disclosed a CVSS 7.8 integer overflow in GIMP's PSP file parser that enables remote code execution when users open malicious files.

ZDI published advisory ZDI-26-633 for an integer overflow in GIMP's parsing of PSP image files. Remote attackers can execute arbitrary code, but exploitation requires user interaction such as opening a malicious file. ZDI assigned CVSS 7.8 and the issue is tracked as CVE-2026-4153.

ZDI Published AdvisoriesSep 9, 05:00 UTC · 7d agoAdvisory CVE-2026-41531

ZDI-26-551: OriginLab OriginPro OGG File Parsing Memory Corruption Remote Code Execution Vulnerability

ZDI advisory ZDI-26-551 discloses CVE-2026-18292, memory corruption in OriginLab OriginPro OGG file parsing enabling remote code execution with user interaction.

OriginLab OriginPro contains a memory corruption vulnerability when parsing OGG files, tracked as CVE-2026-18292 with CVSS 7.8. Remote code execution requires user interaction, meaning the target must open a malicious file or visit a malicious page. ZDI published the finding as advisory ZDI-26-551.

ZDI Published AdvisoriesAug 11, 05:00 UTC · Aug 11, 2026Vulnerability CVE-2026-18292

ZDI-26-646: Progress Software Kemp LoadMaster escape_quotes Uninitialized Memory Remote Code Execution Vulnerability

ZDI publishes ZDI-26-646 for CVE-2026-8037, an authenticated uninitialized-memory remote code execution flaw in Progress Kemp LoadMaster, rated CVSS 7.2.

Zero Day Initiative published advisory ZDI-26-646 describing an uninitialized memory flaw in Progress Software Kemp LoadMaster's escape_quotes function. Successful exploitation allows remote authenticated attackers to execute arbitrary code on affected installations. ZDI rated the issue CVSS 7.2 and assigned CVE-2026-8037.

ZDI Published AdvisoriesSep 9, 05:00 UTC · 7d agoAdvisory CVE-2026-8037

ZDI-26-602: Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution Vulnerability

ZDI disclosed a use-after-free in Foxit PDF Reader (CVE-2026-13128) enabling remote code execution when a user opens a malicious file.

Zero Day Initiative advisory ZDI-26-602 describes a use-after-free flaw in Foxit PDF Reader's document object handling. Exploitation yields arbitrary code execution but requires the target to open a malicious page or file. ZDI assigned CVSS 7.8 and CVE-2026-13128. The advisory does not report active exploitation.

ZDI Published AdvisoriesAug 24, 05:00 UTC · 23d agoVulnerability CVE-2026-13128

ZDI-26-549: OriginLab OriginPro OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

ZDI discloses CVE-2026-18290, a CVSS 7.8 out-of-bounds write in OriginLab OriginPro OGG file parsing enabling remote code execution via malicious files.

The Zero Day Initiative published advisory ZDI-26-549 describing an out-of-bounds write in OriginLab OriginPro's OGG file parsing, tracked as CVE-2026-18290 with a CVSS score of 7.8. The flaw allows remote attackers to execute arbitrary code on affected installations. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file.

ZDI Published AdvisoriesAug 11, 05:00 UTC · Aug 11, 2026Vulnerability CVE-2026-18290

ZDI-26-552: OriginLab Origin Viewer OPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

ZDI discloses CVE-2026-18293, a CVSS 7.8 out-of-bounds write in OriginLab Origin Viewer OPJ file parsing enabling remote code execution via malicious files.

ZDI advisory ZDI-26-552 describes an out-of-bounds write in OriginLab Origin Viewer's OPJ file parsing, tracked as CVE-2026-18293 with a CVSS score of 7.8. The flaw allows remote attackers to execute arbitrary code on affected installations. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file.

ZDI Published AdvisoriesAug 11, 05:00 UTC · Aug 11, 2026Vulnerability CVE-2026-18293

ZDI-26-548: OriginLab OriginPro OPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

ZDI advisory ZDI-26-548 discloses CVE-2026-18289, an out-of-bounds write in OriginLab OriginPro OPJ parsing enabling remote code execution via malicious files.

OriginLab OriginPro contains an out-of-bounds write when parsing OPJ project files, tracked as CVE-2026-18289 with CVSS 7.8. Remote code execution requires user interaction, meaning the target must open a malicious file or visit a malicious page. The flaw was disclosed through ZDI advisory ZDI-26-548.

ZDI Published AdvisoriesAug 11, 05:00 UTC · Aug 11, 2026Vulnerability CVE-2026-18289

ZDI-26-622: Microsoft Windows IKEv2 AES-GCM Decryption Integer Underflow Remote Code Execution Vulnerability

ZDI disclosed CVE-2026-50696, a CVSS 8.1 integer underflow in Windows IKEv2 AES-GCM decryption enabling unauthenticated remote code execution on specific IPsec configurations.

The Zero Day Initiative published ZDI-26-622 describing a remote code execution vulnerability in Microsoft Windows' IKEv2 AES-GCM decryption path, caused by an integer underflow. Authentication is not required for exploitation, but only systems using specific IPsec configurations are affected. ZDI assigned the vulnerability a CVSS score of 8.1 and the identifier CVE-2026-50696.

ZDI Published AdvisoriesSep 8, 05:00 UTC · 8d agoAdvisory CVE-2026-506961

ZDI-26-603: Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability

Foxit PDF Reader has a second annotation use-after-free vulnerability (CVE-2026-13127, CVSS 7.8) allowing remote code execution via malicious files or pages.

ZDI-26-603 describes a use-after-free vulnerability in the annotation feature of Foxit PDF Reader, tracked as CVE-2026-13127 with a CVSS score of 7.8. Successful exploitation allows remote attackers to execute arbitrary code, but requires user interaction such as visiting a malicious page or opening a malicious file. The advisory does not mention any exploitation in the wild.

ZDI Published AdvisoriesAug 24, 05:00 UTC · 23d agoVulnerability CVE-2026-13127

ZDI-26-547: OriginLab OriginPro OPJU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

ZDI advisory ZDI-26-547 discloses CVE-2026-18288, an out-of-bounds write in OriginLab OriginPro OPJU file parsing enabling remote code execution via crafted files.

OriginLab OriginPro contains an out-of-bounds write when parsing OPJU files, tracked as CVE-2026-18288 with CVSS 7.8. Remote code execution requires user interaction, meaning the target must open a malicious file or visit a malicious page. The flaw was disclosed via ZDI advisory ZDI-26-547.

ZDI Published AdvisoriesAug 11, 05:00 UTC · Aug 11, 2026Vulnerability CVE-2026-18288