N-able has released an emergency hotfix for a maximum-severity remote code execution (RCE) flaw affecting its N-central remote monitoring and management (RMM) platform. [...]
CVE-2026-85656 is an OS command injection vulnerability in the Amazon log4j-cve-2021-44228-hotpatch tool for Amazon Linux. This tool injects a Java agent into running JVM processes to patch the Log4j CVE-2021-44228 vulnerability without restarting the process. The flaw allows a local user to execute arbitrary commands with root privileges if the Java process executable path contains embedded newline characters. Versions up to and including 1.3-8.amzn2 are affected. The issue is fixed in version 1.3-9.amzn2.
Hewlett Packard Enterprise (HPE) has released a patch for a critical remote code execution vulnerability in the ArubaOS-CX network operating system. This flaw could allow an attacker to execute arbitrary code remotely on affected devices. The vulnerability is classified as critical due to the potential impact on network infrastructure. No specific affected versions or exploit details are provided in the available information. There is no indication of known exploitation in the wild at this time.
Cisco disclosed multiple vulnerabilities affecting its Secure Email product, IOS XR, Nexus 9000 series switches, and certain IP phone devices. Two medium-severity flaws in Secure Email's S/MIME decryption could allow attackers to intercept and obtain plaintext from encrypted emails. Critical vulnerabilities in IOS XR and Nexus switches could enable remote code execution, authentication bypass, and code injection. Additionally, a high-severity denial-of-service vulnerability affects Cisco IP phones using SIP. Cisco has released patches for the IOS XR, Nexus switches, and IP phone vulnerabilities, but the Secure Email flaws remain unpatched. No active exploitation has been reported for any of these vulnerabilities.
FreePBX version 17.0.2 is affected by a remote code execution (RCE) vulnerability. This flaw allows an attacker to execute arbitrary code on the affected system remotely. The vulnerability is critical in severity and affects Linux systems running Debian or Ubuntu with Asterisk. No specific affected sub-versions or patch information is provided.
Metabase versions 0.58.0 up to but not including 0.58.15, 0.59.0 up to but not including 0.59.12, 0.60.0 up to but not including 0.60.6.3, and 0.61.0 up to but not including 0.61.1.4 contain an authenticated remote code execution vulnerability. This flaw allows an attacker with valid authentication to execute arbitrary code remotely on the affected system.
An SQL injection vulnerability exists in the All-in-One WP Migration and Backup plugin for WordPress. This flaw could allow unauthenticated attackers to execute remote code and potentially take control of affected websites. The vulnerability affects millions of WordPress sites using this plugin. No specific affected versions or patch information is provided in the available data.
Ghost_CMS versions from 0.7.2 up to and including 6.19.0 are affected by a remote code execution vulnerability identified as CVE-2026-29053. This vulnerability allows an attacker to execute arbitrary code remotely on affected systems. The issue is classified as critical severity. No patch or remediation information is provided in the available data. Exploit code is publicly known and categorized as an exploit. The affected platforms include Ubuntu 18.0.4 and Windows 10.
CVE-2026-0768 is a critical remote code execution vulnerability in the AI low-code platform Langflow. It allows unauthenticated attackers to execute arbitrary Python code as root via improper validation in the custom component editor's code validator. The flaw affects all Langflow versions up to 1.4.2. Exploitation has been observed in the wild, primarily for reconnaissance and credential harvesting, with notable attack activity originating from Russia. The vulnerability was reported in July 2025 and publicly disclosed as a zero-day in January 2026.
Forescout researchers conducted an experiment using Anthropic's Claude AI to port a remote code execution (RCE) exploit from one WAGO PLC model (750-852) to another (750-831). The original exploit targets a pre-authentication buffer overflow (CVE-2021-31886) in the Nucleus FTP server, allowing arbitrary ARM shellcode execution. The AI-assisted porting required extensive human oversight, several hours, and significant API costs. While the AI successfully confirmed the vulnerability and generated working payloads, attempts to develop a command-and-control implant resulted in bricking a device. This experiment highlights the potential for AI to reduce the marginal cost of exploit development across related targets but also the current limitations and risks involved.
Langflow version 1.8.4 contains a critical vulnerability that allows path traversal leading to remote code execution (RCE). This flaw enables an attacker to execute arbitrary code on the affected system by exploiting improper handling of file paths.
Over 8,300 Internet-exposed Gitea instances are still unpatched against a critical security flaw exploited in ongoing remote code execution attacks, according to cybersecurity watchdog Shadowserver. [...]
CISA has issued a directive for U.S. federal agencies to patch a remote code execution vulnerability in Citrix NetScaler appliances by a specified deadline. The vulnerability is actively exploited, indicating a significant security risk. No specific affected versions or patch details are provided in the available information.
A Chinese-speaking threat actor tracked as Red Heron rapidly weaponized CVE-2026-60004, a critical Gitea remote code execution vulnerability, within days of public disclosure in July 2026. The actor scanned 1,386 Gitea instances across seven countries, successfully compromising organizations in Canada, Argentina, Taiwan, the United States, and Sri Lanka. Activities included source code theft, credential collection, SSH persistence, and lateral movement, with one case escalating from a vulnerable Gitea server to root access across a three-node Proxmox cluster. An exposed staging server revealed targeting taxonomies using Simplified Chinese labels covering defense, elections, energy, aerospace, telecommunications, and government sectors. The campaign deployed JITTERLY, a C++ Linux implant with 30+ post-exploitation commands, embedding SIXZUT, a previously undocumented LD_PRELOAD rootkit capable of hiding files, processes, and network connections while protecting the implant from termination.
The Kaltura HTML5 Player Library (mwEmbed / html5lib) versions v2.45, v2.103, and earlier v2.x releases contain two vulnerabilities involving insecure deserialization. These flaws allow remote, unauthenticated attackers to read arbitrary local files and execute arbitrary code as the web-server user via the vulnerable mwEmbedLoader.php endpoint. The vulnerabilities stem from unsafe deserialization of user-controlled input and insufficient sanitization of a path parameter, enabling directory traversal and remote code execution. These issues affect legacy Player V2 versions but not the currently supported Player V7. Until patches are applied, restricting or disabling access to the vulnerable endpoint is advised.
Threat actors have compromised over 270 Zimbra Collaboration Suite (ZCS) servers by exploiting a high-severity remote code execution vulnerability. These ongoing attacks have resulted in unauthorized access to multiple Zimbra instances. No specific affected versions or patch information is provided in the available data.
A heap-based buffer overflow vulnerability exists in Konami's Metal Gear Online 3, originating from improper validation of lobby data fields related to kicked players. The affected function processes a list of kicked player identifiers using the lobby data key "kick_num" to determine the number of entries, and individual kicked player IDs supplied via keys in the format "kicked_id_%i". The function does not validate that "kick_num" falls within the expected bounds. The game design limits matches to a maximum of 16 players, and the corresponding buffer for storing kicked player IDs is sized accordingly. If "kick_num" exceeds this limit, the function continues writing the provided player IDs past the end of the intended buffer and into adjacent memory regions. These adjacent regions contain Steam callback handler structures responsible for processing lobby data updates, lobby messages, and other related events. By supplying an oversized "kick_num" value and appropriate "kicked_id_%i" fields, an attacker can overwrite fields within the callback handler structures, including function pointers and callback argument values. Successful exploitation may enable control-flow hijacking, potentially allowing arbitrary code execution within the game process.
The Calix GS7 XGS GS5239XG residential router was initially reported to have a missing authentication vulnerability in its UPnP WANIPConnection service exposed on the WAN interface at TCP port 5000. This could have allowed unauthenticated remote attackers to modify NAT port-forwarding rules, potentially exposing internal LAN devices. However, after thorough investigation and testing by Calix and CERT/CC, it was determined that the default firmware configuration blocks inbound WAN traffic to TCP port 5000, preventing exploitation. No affected customer deployments or required mitigations have been identified. The vulnerability report has been retracted as the issue could not be reproduced under normal conditions.
