Marimo version 0.20.4 is associated with a remote code execution (RCE) vulnerability identified as CVE-2026-39987. The available information is limited, with no detailed technical data or patch information provided.
Langflow versions prior to 1.10.0 contain a remote code execution (RCE) vulnerability identified as CVE-2026-9198. An exploit exists that leverages an API endpoint to obtain a superuser token and then executes arbitrary code on the target system. The exploit has been tested on Ubuntu 22.04.
Ghost_CMS versions from 0.7.2 up to and including 6.19.0 are affected by a remote code execution vulnerability identified as CVE-2026-29053. This vulnerability allows an attacker to execute arbitrary code remotely on affected systems. The issue is classified as critical severity. No patch or remediation information is provided in the available data. Exploit code is publicly known and categorized as an exploit. The affected platforms include Ubuntu 18.0.4 and Windows 10.
CVE-2026-0768 is a critical remote code execution vulnerability in the AI low-code platform Langflow. It allows unauthenticated attackers to execute arbitrary Python code as root via improper validation in the custom component editor's code validator. The flaw affects all Langflow versions up to 1.4.2. Exploitation has been observed in the wild, primarily for reconnaissance and credential harvesting, with notable attack activity originating from Russia. The vulnerability was reported in July 2025 and publicly disclosed as a zero-day in January 2026.
Forescout researchers conducted an experiment using Anthropic's Claude AI to port a remote code execution (RCE) exploit from one WAGO PLC model (750-852) to another (750-831). The original exploit targets a pre-authentication buffer overflow (CVE-2021-31886) in the Nucleus FTP server, allowing arbitrary ARM shellcode execution. The AI-assisted porting required extensive human oversight, several hours, and significant API costs. While the AI successfully confirmed the vulnerability and generated working payloads, attempts to develop a command-and-control implant resulted in bricking a device. This experiment highlights the potential for AI to reduce the marginal cost of exploit development across related targets but also the current limitations and risks involved.
A remote code execution (RCE) vulnerability has been identified in Grav CMS version 2.0.7. This vulnerability allows an attacker to execute arbitrary code on the affected system. No specific technical details or patch information are provided.
Wolf CMS version 0.8.3.1 is affected by a remote code execution (RCE) vulnerability. This allows an attacker to execute arbitrary code on the affected system remotely. The vulnerability is critical in severity and affects versions up to and including 0.8.3.1.
Langflow version 1.8.4 contains a critical vulnerability that allows path traversal leading to remote code execution (RCE). This flaw enables an attacker to execute arbitrary code on the affected system by exploiting improper handling of file paths.
This is a cybersecurity news roundup covering multiple topics including a Log4j vulnerability scare that was later downplayed by developers, ransomware claims involving U.S. Bank linked to a fourth-party provider, the shutdown of container image provider Minimus, and various other incidents such as credential leaks, mobile banking malware expansion, and data breaches. The Log4j vulnerability mentioned is confirmed by developers as a known issue with specific exploitation conditions, not a new critical threat. Other stories include sanctions on Iranian hackers, a cyberattack on Manchester Airports Group, and exposure of sensitive data in breaches. The report provides a broad overview of recent cybersecurity events without focusing on a single exploitable vulnerability or active exploit.
Over 8,300 Internet-exposed Gitea instances are still unpatched against a critical security flaw exploited in ongoing remote code execution attacks, according to cybersecurity watchdog Shadowserver. [...]
CISA has issued a directive for U.S. federal agencies to patch a remote code execution vulnerability in Citrix NetScaler appliances by a specified deadline. The vulnerability is actively exploited, indicating a significant security risk. No specific affected versions or patch details are provided in the available information.
A critical vulnerability chain in the Avada WordPress theme allows an unauthenticated attacker to execute arbitrary PHP code on the server without any user interaction (zero-click). This flaw affects the popular Avada theme and poses a severe risk of remote code execution.
Attackers are now targeting a chain of two Microsoft SharePoint vulnerabilities that can allow them to execute arbitrary code on unpatched servers, according to threat intelligence company Defused. [...]
A Chinese-speaking threat actor tracked as Red Heron rapidly weaponized CVE-2026-60004, a critical Gitea remote code execution vulnerability, within days of public disclosure in July 2026. The actor scanned 1,386 Gitea instances across seven countries, successfully compromising organizations in Canada, Argentina, Taiwan, the United States, and Sri Lanka. Activities included source code theft, credential collection, SSH persistence, and lateral movement, with one case escalating from a vulnerable Gitea server to root access across a three-node Proxmox cluster. An exposed staging server revealed targeting taxonomies using Simplified Chinese labels covering defense, elections, energy, aerospace, telecommunications, and government sectors. The campaign deployed JITTERLY, a C++ Linux implant with 30+ post-exploitation commands, embedding SIXZUT, a previously undocumented LD_PRELOAD rootkit capable of hiding files, processes, and network connections while protecting the implant from termination.
The Kaltura HTML5 Player Library (mwEmbed / html5lib) versions v2.45, v2.103, and earlier v2.x releases contain two vulnerabilities involving insecure deserialization. These flaws allow remote, unauthenticated attackers to read arbitrary local files and execute arbitrary code as the web-server user via the vulnerable mwEmbedLoader.php endpoint. The vulnerabilities stem from unsafe deserialization of user-controlled input and insufficient sanitization of a path parameter, enabling directory traversal and remote code execution. These issues affect legacy Player V2 versions but not the currently supported Player V7. Until patches are applied, restricting or disabling access to the vulnerable endpoint is advised.
Threat actors have compromised over 270 Zimbra Collaboration Suite (ZCS) servers by exploiting a high-severity remote code execution vulnerability. These ongoing attacks have resulted in unauthorized access to multiple Zimbra instances. No specific affected versions or patch information is provided in the available data.
CVE-2026-42167 is a critical vulnerability in the ProFTPD mod_sql module that allows post-authentication SQL injection, potentially leading to remote code execution (RCE).
A heap-based buffer overflow vulnerability exists in Konami's Metal Gear Online 3, originating from improper validation of lobby data fields related to kicked players. The affected function processes a list of kicked player identifiers using the lobby data key "kick_num" to determine the number of entries, and individual kicked player IDs supplied via keys in the format "kicked_id_%i". The function does not validate that "kick_num" falls within the expected bounds. The game design limits matches to a maximum of 16 players, and the corresponding buffer for storing kicked player IDs is sized accordingly. If "kick_num" exceeds this limit, the function continues writing the provided player IDs past the end of the intended buffer and into adjacent memory regions. These adjacent regions contain Steam callback handler structures responsible for processing lobby data updates, lobby messages, and other related events. By supplying an oversized "kick_num" value and appropriate "kicked_id_%i" fields, an attacker can overwrite fields within the callback handler structures, including function pointers and callback argument values. Successful exploitation may enable control-flow hijacking, potentially allowing arbitrary code execution within the game process.
The type confusion bug can lead to V8 sandbox escape and control-flow hijacking of the host process. The post Critical Isolated-vm Vulnerability Leads to RCE on Host appeared first on SecurityWeek .
Bulletin ID: 2026-055-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/14/2026 13:30 PM PDT Description: The AWS Load Balancer Controller is an open-source Kubernetes controller that manages AWS Elastic Load Balancing resources for Kubernetes clusters. We identified CVE-2026-15738, an incorrect rule precedence ordering issue in the Gateway API listener rule generation logic. When both an HTTPRoute and a GRPCRoute are attached to the same Application Load Balancer (ALB) HTTPS listener with the same hostname, the controller assigns ALB listener rule priorities based on route kind rather than route specificity. This causes all HTTPRoute-derived rules to receive lower ALB priority numbers, evaluated first by the ALB, than GRPCRoute-derived rules, regardless of which route is more specific. A namespace-scoped user with permission to create HTTPRoute objects in a namespace admitted by a shared Gateway can create a catch-all HTTPRoute that intercepts traffic intended for a more-specific GRPCRoute in another namespace. Impacted versions: AWS Load Balancer Controller v3.4.1 and any version that includes support for attaching both HTTPRoute and GRPCRoute to the same listener (introduced in PR #4794) Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
