Threats tagged 'rce'

A remote code execution vulnerability exists in Ultralytics due to a command injection flaw in the torch_safe_load function. Exploitation requires user interaction, such as visiting a malicious webpage or opening a malicious file. The vulnerability has been assigned CVE-2026-118615 and a high severity rating by the Zero Day Initiative.

A remote code execution vulnerability exists in Ultralytics' parse_model component that allows attackers to execute arbitrary code on affected installations. Exploitation requires user interaction, such as visiting a malicious webpage or opening a malicious file. The vulnerability has been assigned CVE-2026-118616 and a CVSS rating of 7.8 by the Zero Day Initiative.

A remote code execution vulnerability exists in Ultralytics due to unsafe deserialization in the load_dataset_cache_file function. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file. The vulnerability has a high severity rating of 7.8 assigned by ZDI and is tracked as CVE-2026-118617.

A remote code execution vulnerability exists in Ultralytics' parse_model functionality. Exploitation requires user interaction, such as visiting a malicious webpage or opening a malicious file. The vulnerability is assigned CVE-2026-118618 with a high severity rating by the Zero Day Initiative.

A remote code execution vulnerability exists in Ultralytics related to Google Drive download path traversal. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file. The vulnerability is assigned CVE-2026-118619 with a high severity rating by ZDI.

A remote code execution vulnerability exists in Alpine iLX-F511 devices due to hard-coded SSH credentials. This flaw allows network-adjacent attackers to execute arbitrary code without authentication. The vulnerability has a CVSS rating of 6.3 and is tracked as CVE-2026-118601.

A stack-based buffer overflow vulnerability exists in the vCard parsing functionality of Alpine iLX-F511 devices. Exploitation requires the target device to connect to a malicious Bluetooth device, enabling network-adjacent attackers to execute arbitrary code remotely. The vulnerability has been assigned CVE-2026-118603 and a CVSS rating of 8.0 by the Zero Day Initiative.

A stack-based buffer overflow vulnerability in the Alpine iLX-F511 Framework Service allows physically present attackers to execute arbitrary code without authentication. The vulnerability has a medium severity rating and is tracked as CVE-2026-118604.

A stack-based buffer overflow vulnerability exists in the prh_sdp_service_search_decode function of Alpine iLX-F511 devices. This flaw allows network-adjacent attackers who can pair a malicious Bluetooth device with the target to execute arbitrary code remotely. The vulnerability is assigned CVE-2026-118605 and has a high severity rating with a CVSS score of 8.0 by the Zero Day Initiative.

A remote code execution vulnerability exists in the Alpine iLX-F511 Framework Service that can be exploited by network-adjacent attackers without authentication. This vulnerability allows arbitrary code execution on affected devices and has been assigned CVE-2026-118606 with a high severity rating by the Zero Day Initiative.

A stack-based buffer overflow vulnerability exists in the Alpine iLX-F511 Android Auto Connection Handler that allows physically present attackers to execute arbitrary code without authentication. The vulnerability has a medium severity rating with a CVSS score of 6.8 assigned by ZDI. No affected software versions or patch information are provided.

A stack-based buffer overflow vulnerability in the Android Auto Service of Alpine iLX-F511 devices allows network-adjacent attackers to execute arbitrary code without authentication. This vulnerability has been assigned CVE-2026-118610 and a CVSS rating of 8.8, indicating high severity.

A heap-based buffer overflow vulnerability exists in the Bluetooth OBEX packet handling of Alpine iLX-F511 devices. This flaw allows attackers with physical proximity to execute arbitrary code without requiring authentication. The vulnerability is tracked as CVE-2026-118611 and has a CVSS rating of 6.8, indicating a medium severity level.

HPE has released patches addressing 72 vulnerabilities in its Aruba networking products' AOS-8 and AOS-10 wireless operating systems, including eight maximum-severity flaws that could allow unauthenticated remote code execution and authentication bypass. These vulnerabilities affect various hardware and virtual machines compatible with these operating systems. HPE recommends restricting management interfaces and applying patches promptly. No exploitation in the wild has been reported.

CVE-2026-111497, known as Brotli2Shell, is a critical out-of-bounds write vulnerability in Google's Brotli C decoder library. It affects many widely used software projects that decompress Brotli data, including Node.js, .NET, Bun, Envoy Proxy, Istio, Python HTTP clients, FFmpeg, Apache Arrow, ClickHouse, and PHP for Windows. The flaw can be triggered by decompressing crafted Brotli data, potentially leading to process crashes, memory leaks, or remote code execution. The vulnerability has a high CVSSv4.0 score of 9.2 assigned by Google. Patches have been released for the Brotli library and major runtimes, but some projects had not shipped fixed releases as of late October 2026. Applications bundling their own Brotli decoder require individual updates.

Two new vulnerabilities affecting specific Intel processors have been identified. CVE-2025-21090 allows an unprivileged actor using the AMX and AVX CPU instructions to render the host machine inoperative. CVE-2025-22840 allows an unprivileged actor using the prefetchit CPU instruction to access memory contents without authorization, potentially leading to remote code execution. Google has stated no customer action is required as they will update systems during planned maintenance windows. No evidence of exploitation has been reported.

This report summarizes multiple cyber threats and incidents observed in late October 2026, including large-scale breaches, supply-chain attacks, AI-enabled cybercrime tools, and critical software vulnerabilities. Notable incidents include a cyberattack on Japanese cloud provider Onamae Desktop Cloud affecting over 26,000 servers, a data breach at India's State Bank of India exposing nearly 3,900 customer records, and a supply-chain compromise of the LiteLLM AI gateway. AI-enabled tools are facilitating large-scale fraud and ransomware attacks targeting critical sectors in the United States. Critical PHP vulnerabilities enabling remote code execution are being widely exploited, with most instances unpatched. Oracle and GitLab have released patches for numerous critical vulnerabilities, including a critical remote code execution flaw in GitLab and a privilege escalation vulnerability in Arista VeloCloud Orchestrator that has been exploited in the wild.

A remote code execution vulnerability exists in libwebsockets due to improper handling of MQTT PUBACK packets, allowing unauthenticated attackers to execute arbitrary code on affected systems. The vulnerability has been assigned CVE-2026-114550 and a high severity rating by the Zero Day Initiative.

A remote code execution vulnerability exists in Meta FAIRChem's load_and_preprocess_data function due to deserialization of untrusted data. Exploitation requires user interaction, such as visiting a malicious webpage or opening a malicious file. The vulnerability has a high severity rating of 7.8 assigned by ZDI.

A remote code execution vulnerability exists in Meta FAIRChem due to deserialization of untrusted data in the ion_db_path component. Exploitation requires user interaction, such as visiting a malicious webpage or opening a malicious file. The vulnerability has a high severity rating assigned by ZDI.