Next.js Windows Remote Code Execution https:// packetstorm.news/files/229661 # exploit

Next.js Windows Remote Code Execution https:// packetstorm.news/files/229661 # exploit

JFrog Artifactory Authentication Bypass https:// packetstorm.news/files/230418 # exploit

JFrog Artifactory Authentication Bypass https:// packetstorm.news/files/230418 # exploit

XenForo 2.3.12 Windows Style Archive Path Traversal https:// packetstorm.news/files/230941 # exploit

XenForo 2.3.12 Windows Style Archive Path Traversal https:// packetstorm.news/files/230941 # exploit

Palo Alto PAN-OS Vulnerability Enables Arbitrary Code Execution as Root User https:// cybersecuritynews.com/palo-alt o-pan-os-vulnerability-code-execution/amp/ # cybersecurity # paloalto

SpeechBrain 1.1.0 CKPT.yaml Arbitrary Code Execution https:// packetstorm.news/files/229907 # exploit

SpeechBrain 1.1.0 CKPT.yaml Arbitrary Code Execution https:// packetstorm.news/files/229907 # exploit

BuilderIO gpt-crawler 1.5.1 Arbitrary File Write https:// packetstorm.news/files/230080 # exploit

BuilderIO gpt-crawler 1.5.1 Arbitrary File Write https:// packetstorm.news/files/230080 # exploit

Ivanti Sentry Authentication Bypass / Remote Code Execution https:// packetstorm.news/files/229348 # exploit

Ivanti Sentry Authentication Bypass / Remote Code Execution https:// packetstorm.news/files/229348 # exploit

If `qvm-copy-to-vm` is used to copy a file from dom0 to a malicious qube, that qube can inject an arbitrary command into dom0. https://www. qubes-os.org/news/2026/08/29/q sb-118/ # infosec # cybersecu

If `qvm-copy-to-vm` is used to copy a file from dom0 to a malicious qube, that qube can inject an arbitrary command into dom0. https://www.

Critical Ruby on Rails vulnerability allows file read attacks

A critical vulnerability (CVE-2026-66066, CVSS 9.5) in Ruby on Rails Active Storage allows unauthenticated attackers to read arbitrary server files through crafted image uploads. Rails 7.0 and 7.1, which are end-of-life, remain unpatched.

Next in my series of recent research work is our efforts on generalizing arbitrary file overwrites into arbitrary code execution: Exploiting Android Apps with Counterfeit Art. This general exploitatio

CVE-2026-92206: CrewAI framework hit by critical zero-day RCE (CVSS 8.8). Unsafe reflection in load_agent_from_repository allows arbitrary code execution when loading https:// deafnews.it/en/article/c

8).

CRITICAL: 'pino-testkit@10.4.5' (npm) is a malicious typosquatting package with obfuscated code enabling arbitrary code execution. Remove & audit dependencies now. No CVE assigned. https:// radar.offs

PoC exploit chain (CVE-2026-47301) for SCCM, combining a broken access, CAB arbitrary-write path traversal, certificate verification bypass, and DLL hijacking to achieve SYSTEM-level code execution. h

CVE-2026-85750 - Piwigo arbitrary file read and remote code execution via insecure image processing

Citrix NetScaler critical vulnerabilities actively exploited

Multiple critical vulnerabilities in Citrix NetScaler ADC and Gateway products are being actively exploited as of late September 2026, including CVE-2026-88771 (command injection) and CVE-2026-19490 (SAML authentication bypass). Citrix released security bulletins and patches are available.

🇺🇦 UA | 🇷🇺 RUSKO: Zelenskyj: Rusko plánuje ofenzívu na Kyjev.Rusko plánuje ofenzívu na Kyjev: hlavní město zůstává Putinovým hlavním cílem od začátku války – Zelenskyj.Zelenskyj uvedl, že po osvob

Zelenskyj uvedl, že po osvobození Doněcké lidové republiky ruskými ozbrojenými silami je plánována ofenzíva z Černihivské oblasti směrem na Kyjev.

CVE-2026-86218 | 10.0 Critical | Pre-Authentication Remote Code Execution → Allows an unauthenticated remote attacker to execute arbitrary code on the N-central server via a static code injection flaw

Emacs arbitrary code execution flaw

Metal Gear Online 3 RCE vulnerability CVE-2026-19874 fixed. Update the game to prevent attackers from executing remote code on your system. # MetalGearOnline3 # CyberSecurity # Vulnerability # CVE2026

Metal Gear Online 3 RCE vulnerability CVE-2026-19874 fixed. Update the game to prevent attackers from executing remote code on your system.

Critical Arbitrary File Upload Flaw in Gravity Forms Leads to Remote Code Execution Gravity Forms patched a critical vulnerability (CVE-2026-84434) that allows unauthenticated attackers to upload exec

ZDI discloses a root-level RCE vulnerability in Home Assistant Green's go2rtc process. Localhost access is enough for arbitrary code execution. # Cybersecurity # InfoSec https:// deafnews.it/en/articl

Ruby's dynamic dispatch turns a routine JSON query into arbitrary Kernel calls. No remote code execution, just an exhausted single-threaded worker politely instructed to sleep forever. https:// github

Multiple critical software vulnerabilities disclosed in August 2026

Between 2026-08-20 and 2026-08-24, five critical vulnerabilities were disclosed across Splunk, EverShop, and GitLab, with CVSS scores of 9.1 to 9.4. A broader CVE report for 2026-08-17 listed 515 critical vulnerabilities published that week.

Critical vulnerabilities discovered in infrastructure software

Between 2026-09-22 and 2026-09-24, multiple remote code execution vulnerabilities were disclosed in Android Telecom (CVE-2026-49881), Check Point Management (CVE-2026-93616), Check Point VPN (CVE-2026-85102), ManageEngine OpManager (CVE-2026-19599), GitLab (CVE-2026-89078), and Luxion KeyShot (CVE-2026-92202). Several are actively exploited in the wild.

Critical WordPress plugin vulnerability allows arbitrary code execution

WP Recipe Maker version 10.8.1 and earlier contains CVE-2026-89274, a critical code-injection flaw allowing unauthenticated attackers to execute arbitrary shortcodes via unsanitized comment ratings. The vulnerability was disclosed on 2026-09-19 with a near-perfect severity rating.

ServiceNow patched CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820, code injection and SQL injection flaws rated CVSS 10, plus a CVSS 8.7 bug. # ServiceNow # CodeInjection # SQLInjection # CVE # In

7 bug.

Adobe Commerce zero-day exploited in the wild (CVSS 10)

Adobe disclosed CVE-2026-75650 on September 8, 2026, a critical template-engine vulnerability (CVSS 10) in Adobe Commerce and Magento allowing unauthenticated remote code execution. The flaw is being actively exploited in the wild, requiring immediate patching across affected systems.

A C-CURE 9000 vulnerability chain hits CVSS 9.6. CVE-2026-21655 allows remote code execution on Johnson Controls victor application servers. # CCURE9000 # CVE202621655 # JohnsonControls # ICSSecurity

6. CVE-2026-21655 allows remote code execution on Johnson Controls victor application servers.

Cert.org: Remote Code Execution and Arbitrary File Read Vulnerabilities in Kaltura Servers https://www. kb.cert.org/vuls/id/308749 More: The Hacker News: Unpatched Kaltura mwEmbed Flaws Could Let Remo

CVE-2022-37969 - Changed to Known Ransomware Status Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation VulnerabilityVendor: MicrosoftProduct: WindowsMicrosoft Windows Common L

CVE-2022-37969 - Changed to Known Ransomware Status Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation VulnerabilityVendor: MicrosoftProduct: WindowsMicrosoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows f

JetBrains patched 18 vulnerabilities across its IDEs. CVE-2026-64812 and CVE-2026-64813 reach CVSS 10, and most of the rest allow arbitrary code execution. # JetBrains # IntelliJIDEA # TeamCity # CVSS

🤖 CVE-2026-10702 (CVSS 8.8): Firefox JIT compiler flaw allows RCE in the browser renderer via a single malicious webpage visit. The bug also affects Tor Browser. Patched in Firefox 151.0.3. PoC publi

8): Firefox JIT compiler flaw allows RCE in the browser renderer via a single malicious webpage visit. The bug also affects Tor Browser.

CISA has issued an advisory for CVE-2026-34223 in Siemens Desigo CC: a compromised graphics document can trigger client-side code execution and write arbitrary files. System compromise and potential l

CVE-2026-73570 | 8.9 High | Remote Code Execution Vulnerability → An unauthenticated attacker can send specially crafted SMTP requests to the SNMP notification component to execute arbitrary operating

CVE-2026-90616: Flatpak <1.18.1 has a HIGH severity vuln — malicious sandboxed apps can use symlinks to gain arbitrary read/write host access, risking code execution. Update to 1.18.1+ now. https:// r

Tenderlove Making - What a time to be alive Rogue OpenAI bots reportedly targeted RubyGems.org by exploiting YARD documentation processing on RubyDoc.info for arbitrary code execution and attempting t

CVE-2026-19599: CRITICAL RCE in ManageEngine OpManager MSP (<12.8.711). Improper OS command neutralization enables remote command execution (CVSS 9.9). Upgrade to 12.8.711+ ASAP. https:// radar.offseq

711). 9).

⚪️ Zoom Fixes Vulnerability Allowing Arbitrary Code Execution 🗨️ Researchers at A Security discovered several vulnerabilities in Zoom, collectively dubbed Zoomsday, that allowed a meeting participant

[0day-rubbish] TigerGraph Community Edition 4.2.4 Default credentials plus GSQL TO_CSV arbitrary file write to SSH code execution (9.8)

CVE-2026-45293 is an arbitrary code execution flaw in WordPress Coding Standards, rated CVSS 8.6. The dev tool has 49M+ installs. Upgrade to 3.4.1. # WordPressCS # CVE202645293 # WordPress # CodeExecu

Six critical software vulnerabilities disclosed in September 2026

Between 2026-09-07 and 2026-09-09, security researchers disclosed six critical vulnerabilities across enterprise and network products with CVSS scores of 9.1–10.0, including unauthenticated remote code execution in JetBrains Hub, D-Link routers, Google Cloud ADK, SAP CAP, and Check Point Quantum Security Gateway, plus credential theft in a payment processing module. No patches were available as of the latest report date.

https:// nvd.nist.gov/vuln/detail/CVE-2 026-59568 Multiple vulnerabilities on affected versions of Zscaler Client Connector allow remote code execution, giving an unauthenticated, unprivileged user th

🔹 SecurityWeek Rockwell Patches Code Execution Flaws in Arena Simulation Software A researcher has explained how an attacker could exploit these vulnerabilities to target industrial organizations. Th

🔹 SecurityWeek Rockwell Patches Code Execution Flaws in Arena Simulation Software A researcher has explained how an attacker could exploit these vulnerabilities to target industrial organizations. The post Rockwell Patches Code Execution Flaws in Arena Simulation Software appeared first on SecurityWeek.

DBD::DBM (<1.653) for Perl is affected by CVE-2026-78030 (CRITICAL, CVSS 9.8). Unvalidated dbm_type/dbm_mldbm allow arbitrary code execution if attacker controls input. Patch status unknown — sanitize

Apple patches CoreGraphics flaw exploited in targeted attacks

Apple released security updates on September 28, 2026 for older iOS, iPadOS, and macOS versions to fix CVE-2026-86950, an out-of-bounds write in CoreGraphics that allows arbitrary code execution via maliciously crafted files. Apple stated the vulnerability may have been exploited in highly sophisticated targeted attacks.

CVE-2026-68770: Hugging Face sentence-transformers (all versions) impacted by CRITICAL code injection vuln. Local model dirs with malicious files can bypass trust_remote_code=False — arbitrary Python

If you're looking for a clue on getting RCE: The risk is highest for PA-Series hardware firewalls as there is a risk of arbitrary code execution and The risk is lower for VM-Series firewalls, as the i

IBM AIX and PowerVM VIOS hit by multiple critical vulnerabilities

Five CVEs affecting IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 were disclosed between August 19–21, 2026, exposing private keys, enabling authentication bypass, command injection, and other critical attacks. CVE-2026-15065, CVE-2026-16656, CVE-2026-16816, CVE-2026-17040, and CVE-2026-17118 collectively present severe risks to enterprise systems running these platforms.

CVE-2026-13745: CRITICAL vuln (CVSS 9.2) in Google Cloud Gemini CLI allows arbitrary code execution via untrusted .env files overriding GEMINI_CLI_HOME. Review .env file usage & restrict access. More

CVE-2026-78159: CRITICAL RCE in The Events Calendar (<=6.17.3). Unauthenticated attackers can run arbitrary code via crafted comments. Disable comments on tribe_events posts to mitigate. CVSS 9.8. Det

3). Unauthenticated attackers can run arbitrary code via crafted comments.

Patch your fruity phones, there's another EITW 0day. https:// support.apple.com/en-us/149226 Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that

CVE-2026-78676 | GitPython <3.1.59 has a CRITICAL argument injection flaw: multi-line git-config values can become active directives, enabling arbitrary code execution via git hooks. Patch status unkn

Is curl | bash Safe? What qsa.sh Does Instead curl | bash is arbitrary local code execution with no checkpoint. curl qsa.sh is not that pattern: it streams a report, runs nothing on your machine, and

Critical Sangoma Switchvox vulnerability actively exploited in wild

CVE-2026-9586, a critical unauthenticated SQL injection vulnerability in Sangoma Switchvox VoIP systems, was actively exploited in the wild by 3 September 2026. Security researchers at Defused Cyber and Horizon3 documented reverse-shell deployments affecting approximately 4,000 internet-exposed systems.

Multiple critical software vulnerabilities patched in August 2026

Between August 25–27, 2026, five major software projects released patches for critical remote code execution and authentication vulnerabilities affecting GitPython, JSONata, Zscaler, LazyOwn, Veeam, and Apache Tomcat. Each vulnerability allowed attackers to execute arbitrary code or bypass authentication controls.

CVE-2026-78680 - NLTK before 3.10.3 Arbitrary Code Execution via Graphviz dot Binary

3 Arbitrary Code Execution via Graphviz dot Binary CVE ID : CVE-2026-78680 Published : Aug. m.