Threats Tagged 'rce'

CVE-2026-64638 is a high-severity pre-authentication reflected cross-site scripting (XSS) vulnerability in WordPress login pages that can lead to remote code execution (RCE) under specific conditions. The flaw allows attacker-controlled JavaScript to execute in the browser of a visitor after a failed login attempt. Exploitation requires a logged-in administrator to interact with an attacker-controlled page, potentially enabling PHP code execution on the server. The vulnerability affects default WordPress installations and was patched in WordPress 7.0.3 and backported to versions back through 4.7. Versions older than 4.7 remain vulnerable. WordPress recommends immediate updating, and automatic background updates should apply the patch automatically. No in-the-wild exploitation has been reported as of the advisory date.

NMFTA research shows a Bendix EC80 brake controller safety recall also patched remote code execution and DoS vulnerabilities. The post Truck Brake Controller’s Safety Recall Doubled as Hidden Security Fix appeared first on SecurityWeek .

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5.

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5.

The flaws can be exploited for remote code execution, authentication bypass, and EncryptInterceptor bypass. The post CISA Warns of Exploited Langflow, N-central, and Tomcat Vulnerabilities appeared first on SecurityWeek .

Research indicates that over 40% of AI-generated code contains security issues, often due to missing framework- and version-specific security details. To address this, an open-source project called AI Code Security Cards provides library-specific security guidance for developers and AI coding agents. The project covers more than 60 libraries and frameworks across multiple programming languages, offering practical instructions to mitigate common security pitfalls. This initiative aims to improve the security posture of AI-generated code by guiding coding agents on unsafe defaults, validation, authentication patterns, and security changes between library versions.

TP-Link has released patches for 15 vulnerabilities in the zero-touch provisioning (ZTP) feature of its Omada network devices. These vulnerabilities could be chained with previously disclosed flaws to enable remote code execution (RCE) by attackers. The vulnerabilities affect the ZTP mechanism, which is used to simplify device deployment and configuration. No known exploits are reported in the wild at this time.

A pickle deserialization vulnerability (CVE-2026-14890) exists in the SGLang open-source framework's expert-parallel backup subsystem. This vulnerability allows unauthenticated remote code execution if the subsystem is enabled and reachable over the network. The issue arises because a ZeroMQ PULL socket binds to an external IP without authentication or deserialization safeguards, allowing malicious pickle payloads to be processed. No patch is currently available, and the maintainers have not responded to coordination efforts. Mitigations include disabling the pickle IPC feature and restricting network access to the vulnerable interface.

A set of three vulnerabilities were discovered in the BigWave driver on the Pixel 9 device, which is accessible from the mediacodec sandboxed context. One of these bugs enables a use-after-free condition that allows escaping the mediacodec sandbox and achieving arbitrary kernel read/write on the Pixel 9. The vulnerabilities were fixed on January 5, 2026. The BigWave driver accelerates AV1 decoding and is exposed to userland processes in the mediacodec SELinux context, which is intended to be constrained. The use-after-free arises from a race condition between ioctl processing and a worker thread handling hardware jobs, leading to a kernel object being freed while still referenced.

Bulletin ID: 2026-072-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 08/03/2026 13:30 PM PDT Description: Strands Agents is an open-source SDK for building AI agents. The strands-agents-tools package provides pre-built tools for use with the SDK, including the shell tool for executing operating system commands on the agent's host. We identified CVE-2026-18733. The shell tool includes a human consent gate that prompts the operator to approve commands before they run. The tool also exposed a non_interactive parameter in the input schema that the large language model (LLM) could control. A crafted prompt, for example one delivered through untrusted content the agent reads (indirect prompt injection), could set non_interactive to true, which bypasses the consent gate and allows arbitrary operating system commands to execute on the agent's host without operator approval. Impacted versions: < 0.8.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.