Ecava_ntegraXor version 16.0.701.10 contains a remote code execution (RCE) vulnerability that allows an attacker to execute arbitrary code on the affected system remotely.
CISA has issued a warning about a critical vulnerability in MikroTik RouterOS that allows for remote code execution or denial-of-service conditions without authentication. This flaw poses a significant risk to affected systems if exploited. No specific affected versions or patch information are currently provided.
Google Threat Intelligence Group (GTIG) reports that AI is significantly accelerating the discovery and exploitation of software vulnerabilities, with AI-discovered flaws more likely to enable remote code execution. The volume of disclosed vulnerabilities doubled in 2026, with a notable increase in high-risk and exploited vulnerabilities. AI-discovered vulnerabilities tend to have higher impact, with 50% enabling remote code execution compared to 26% for non-AI discoveries. Exploitation of known vulnerabilities (n-days) is rising, possibly due to AI-assisted automation in weaponizing these flaws. AI-related vulnerabilities in AI systems themselves are also increasing, though zero-day exploitation in AI infrastructure has not yet been observed. The trend suggests continued growth in vulnerability discovery and exploitation driven by AI capabilities.
A critical remote code execution (RCE) vulnerability chain has been demonstrated affecting OpenBao and HashiCorp Vault. OpenBao has released patches in versions 2.6.3 and 2.7.0 to fully mitigate the issue. However, HashiCorp Vault remains exposed due to a lack of coordinated disclosure and official mitigation. The exploit requires only unauthenticated access and a specific Raft snapshot policy to achieve full server compromise. This is the second RCE ever found in Vault's codebase and is considered highly plausible in real-world environments.
A security researcher spent approximately 80 days reverse engineering ARM32 firmware of a white-label OEM IoT DVR platform deployed on over 28,000 internet-facing devices. The research uncovered an unauthenticated remote code execution (RCE) vulnerability via a protocol authentication bypass using static AES-256-CBC keys, an unsigned root firmware upgrade execution chain, and a command injection vulnerability due to insufficient input sanitization. Despite these findings, the exploit did not yield practical impact due to patched bench hardware, dormant update opcodes, and lack of vendor security programs. The vulnerability remains unpatched and unexploited in the wild.
An empirical evaluation of NVIDIA OpenShell v0.1.2 sandbox policy enforcement was conducted on macOS using a local microVM driver. The study tested 123 trials against documented egress controls and found no bypass of documented controls. However, egress was observed through operator-opened paths such as read-write rules, query and header values on GET-only rules, audit-mode rules, and auto-approval mechanisms. The evaluation highlights limitations in policy enforcement but no security bypasses were confirmed. The test environment and logs are publicly available for verification.
Citrix has confirmed that two critical NetScaler remote code execution vulnerabilities, tracked as CVE-2026-88771 and CVE-2026-88772, are being exploited in attacks and that it has released security updates to fix the flaws. [...]
This content is a curated list of publicly accessible, keyless (zero-authentication) cyber threat intelligence (CTI) and infostealer API endpoints useful for rapid triage and investigation. It includes various free APIs for credential exposure, infrastructure reconnaissance, vulnerability scoring, and botnet command-and-control feeds. Additionally, an open-source Python script is provided to query these endpoints concurrently, facilitating efficient threat analysis workflows.
This writeup describes a vulnerability chain starting from leaked account credentials leading to remote code execution (RCE) on a web server. The attacker discovered exposed functions without rate limiting that allowed enumeration of valid accounts and credential leakage. Using the leaked credentials, the attacker gained account access and found a file upload feature that accepted .shtml files. Leveraging Server-Side Includes (SSI) support, the attacker executed server-side commands and bypassed firewall restrictions to achieve RCE. The vulnerabilities were responsibly disclosed and patched.
CyberCodex v3.2 is an open-source Python CLI tool designed to aggregate cyber threat intelligence (CTI) from 22 public sources without requiring API keys. It provides live enrichment of indicators of compromise (IOCs) and hashes, vulnerability prioritization using MITRE CVE data combined with exploitation probability scores, and telemetry on infostealers and breaches. The tool also includes offline encyclopedic data on advanced persistent threat (APT) operations and actor profiles, supporting multiple languages and exporting data in Markdown or JSON formats.
CVE-2026-96883 is a type confusion vulnerability in the pgcollection extension for PostgreSQL. It arises from incorrect type coercion logic when an authenticated user requests a stored icollection value as a type incompatible with its actual stored type. This flaw can cause the PostgreSQL backend to crash or allow arbitrary code execution. The vulnerability affects pgcollection versions 2.0.0 through 2.1.1. It has been fixed in version 2.1.2. Amazon RDS for PostgreSQL and Amazon Aurora PostgreSQL are not impacted as they ship version 1.1.1, which does not contain this issue. No workarounds are available.
A remote code execution (RCE) vulnerability identified as CVE-2026-86060 affects MikroTik RouterOS versions 7.0 up to but not including 7.23.4, and versions 7.24.0 up to but not including 7.24.2. Exploit code leveraging this vulnerability is publicly available, involving MikroTik CHR 7.23.3 (x86_64) and Python3-paramiko on Kali Linux 2025.x. No official patch or vendor advisory details are provided.
CVE-2026-87902 is a critical unauthenticated remote code execution vulnerability in WordPress versions 4.7.0 through 7.1.1. It allows attackers to include arbitrary PHP files outside the active theme directories, potentially leading to code execution. The flaw was patched in WordPress 7.1.2 and backported to supported branches down to 4.7. Exploitation attempts began shortly after the patch release, with attackers writing malicious PHP files to disk to execute shell commands. Immediate updating to version 7.1.2 or later is strongly advised.
A critical remote code execution vulnerability (CVE-2026-94127) affects F5 BIG-IP Access Policy Manager (APM) when configured as an OAuth Authorization Server. Unauthenticated attackers can exploit this zero-day flaw by sending malicious traffic to vulnerable BIG-IP appliances. The vulnerability impacts specific versions of BIG-IP APM and has been actively exploited in the wild. F5 has released hotfixes addressing the issue, and CISA has added it to its Known Exploited Vulnerabilities list, urging rapid patching.
RCEKit is an open-source toolkit designed to detect and confirm remote code execution (RCE) vulnerabilities during authorized penetration testing and security research. It uses multiple methods to distinguish confirmed RCE from weaker signals or false positives by generating unique tokens and verifying their presence in target responses or out-of-band callbacks. The tool has been tested against real-world CVEs such as Webmin CVE-2019-15107, Apache Struts2 S2-001, and Log4Shell CVE-2021-44228, demonstrating its ability to confirm or classify RCE findings accurately. RCEKit does not report uncertain cases as confirmed, instead assigning them lower confidence tiers. It supports testing via URLs or captured HTTP requests and offers various probing methods, including reflected, eval, time-based, lookup, and deserialization injection techniques. The tool is intended for use only on authorized targets and requires careful configuration due to the high volume of requests it generates.
WordPress patched a vulnerability called Click2Shell that allowed attackers to automatically install and preview inactive themes via specially crafted URLs. This flaw could lead to remote code execution (RCE) by abusing how theme slugs are interpreted differently by the themes API and JavaScript in an administrator's browser. Attackers could force installation of attacker-selected themes fetched from the official WordPress.org catalog without administrator consent. Some inactive third-party themes could be exploited for PHP code execution during the Customizer preview, enabling attackers to execute code under the WordPress server account without needing an attacker WordPress account. The vulnerability was fixed in WordPress version 7.1.1 and backported to versions as early as 4.7.
A critical vulnerability (CVE-2026-91843) affects Check Point Security Management and Log Server products, allowing unauthenticated remote code execution with root privileges via the login process. No evidence of active exploitation in the wild has been reported. Check Point has issued patches and advises immediate updates for systems without automatic patching. Additionally, Tanium and Kaspersky have patched multiple vulnerabilities in their products, including SQL injection and code execution flaws. These vulnerabilities pose significant risks if left unpatched.
Cisco has released patches for multiple critical vulnerabilities affecting Secure Firewall Management Center (FMC), Identity Services Engine (ISE), and Nexus Dashboard. These vulnerabilities include remote code execution, command injection, authentication bypass, SQL injection, and other flaws that could lead to root access and denial-of-service conditions. Some of the vulnerabilities have been publicly disclosed and exploited in the wild, including a zero-day authentication bypass in ISE. Cisco has issued security advisories detailing these issues and providing fixes.
MLflow's dspy and statsmodels model flavors contain vulnerabilities that bypass the MLFLOW_ALLOW_PICKLE_DESERIALIZATION safety control designed to prevent unsafe pickle deserialization. The dspy flavor conditionally applies this control only if the model path ends with .pkl, allowing bypass if the file extension differs. The statsmodels flavor does not apply the control at all. This allows arbitrary remote code execution via malicious pickle payloads when loading models through these flavors. The vulnerability was confirmed in MLflow 3.12.0. The statsmodels flavor issue is patched in versions 3.15.0 and later. Users should upgrade and avoid using the dspy flavor until a fix is available.