Apache HTTP Server mod_http2 heap bug can yield RCE (CVE-2026-119618)
The advisory rates the assign_headers race critical and also covers mod_h2 2.0.8 through 2.0.42.
Stories per day · 30 days
51 RSS
Relatedphp65php2shell38zdi26zero-day24wordpress23gitlab17kev17cisa12originlab12patch12unauthenticated12buffer-overflow11cisco11deserialization11microsoft10integer-overflow9pan-os9ci-cd8
766 stories, newest first · one card per story
Stories tagged #rce
N-able takes hosted N-central offline after Able2Shell PoC release
A researcher published proof-of-concept code for 33 issues, including unauthenticated RCE; N-able reports scanning but no confirmed compromises.
Four Windows Remote Desktop Client flaws can execute code
The highest score is 8.8 for a double-free; one bug needs only local low privileges, not a network connection.
Barracuda Email Security Gateway Pre-Auth RCE Discovered
Chained CVE-2026-116606 and CVE-2026-111560 enable pre-auth remote root code execution on Barracuda ESG 9.4.0.027.
1
Meta fairseq load_audio_path flaw can run code (ZDI-26-913)
ZDI rates the unpatched issue 7.8; the user must visit a malicious page or open a file.
Meta Detectron2 checkpoint loading can run code (ZDI-26-912)
Untrusted deserialization in detection_checkpoint is unpatched; ZDI rates it CVSS 7.8.
Meta fairseq Wav2Vec YAML parsing can run code (ZDI-26-914)
ZDI rates the unpatched flaw 7.8; a user must open a malicious file for code execution.
Meta FAIRChem load_inference_model deserialization bug allows code execution
ZDI-26-953 is an unpatched FAIRChem flaw rated 7.8 that needs a malicious page or file.
SGLang RCE exploited at NEAR AI; user and agent data taken
About 100 Private Chat accounts and 18 agents were exposed; two Cloud API keys were revoked and no CVE was named.
Apache Airflow CeleryExecutor vulnerability allows forged callback workloads
Apache Airflow CeleryExecutor ran callback workloads without workload-token validation, allowing arbitrary code execution on Celery workers.
Researchers Exploit ForgeRock Default Credentials to Remotely Unlock Cars
Researchers remotely accessed vehicle data and controls after RCE on production ForgeRock servers; automakers fixed the flaws in hours.
Hyperglass flaws can become pre-auth RCE on exposed ISP installs
The note names no CVE, affected versions, or fix, and does not say any provider was compromised.
X.Org libXrender reply overflow allows remote code execution
Exploitation needs a connection to a malicious X11 server; ZDI rates CVE-2026-88807 at CVSS 8.8.
Wireshark LoRaWAN decryption flaw can yield remote code execution
Only Wireshark instances with LoRaWAN decryption enabled are vulnerable; ZDI rates it CVSS 7.1.
NVIDIA Megatron-LM checkpoint flaw allows code execution
Opening a malicious checkpoint file is required; ZDI rates CVE-2026-65110 at CVSS 7.8.
Dokploy v0.31.0 password change yields host RCE via backtick
A member changing a database password can reach host command execution; the researcher live-tested the official v0.31.0 image.
Microsoft Paint vulnerability enables remote code execution (CVE-2026-83844)
An out-of-bounds read in Windows Paint build 11.2609.401.0 lets unauthenticated attackers execute code remotely without interaction.
1
React Server Components vulnerability allows unauthenticated RCE
React Server Components vulnerability GHSA-xqc2-xf4c-x3h3 affects packages react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack versions 19.0.0-19.3.0.
3
Barracuda Email Security Gateway Pre-Auth RCE disclosed
The advisory mentions CVE-2026-116606 and CVE-2026-111560 for Barracuda Email Security Gateway.
PHP2Shell heap exploitation leads to RCE in PHP
Author shares step-by-step research on PHP2Shell UAF chain using OOM and session handling for remote code execution.
1
WordPress update race exposes sites to exploited CVE-2026-119977
WordPress 4.7-7.1.3 vulnerable to actively exploited race condition during core updates allowing remote code execution.
Apache Axis 1.x unauthenticated remote class instantiation via SOAP (CVE-2026-90436)
Deserialization of inbound SOAP faults in Apache Axis 1.x allows unauthenticated remote class instantiation; unsupported as end-of-life.
Metasploit adds unauthenticated RCE modules for perimeter devices
New modules cover Flowise, SPIP, OpenBullet2, GitLab, Portainer, and a NetScaler bug the vendor said was exploited.
5
Origin Viewer OPJ parsing heap-based buffer overflow enables remote code execution (CVE-2026-114568)
Origin Viewer OPJ file parsing allows remote code execution with user interaction required (CVE-2026-114568).