SecurityNewA Paint bug that hides in the picture
A high-severity flaw in Microsoft Paint allows remote code execution, and the patch isn't reaching everyone through the Store.
> Search
30 results for “code execution”
SecurityNew
SecurityWordPress RCE flaw now exploited in the wild
CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities Catalog after attackers began abusing the WordPress Core race condition.
AI & MLLangflow Patches Two 9.8 Flaws, One an Auth Bypass
IBM fixed four vulnerabilities in its AI agent framework, including two critical bugs that could let attackers bypass authentication and run arbitrary code.
SecurityAlpine's GitLab rebuild after RCE try
Alpine Linux rebuilt its GitLab server and reset passwords after attackers tried to exploit a maximum-severity flaw and it could not rule out code execution.
Cyber CrimeUnpatched AhsayCBS Bugs Exploited as Zero-Days
Attackers are chaining two unpatched AhsayCBS vulnerabilities to gain remote code execution and deploy webshells, with at least five organizations targeted.
Cyber CrimeRCE flaw in Rejetto HFS now exploited
Attackers are exploiting CVE-2026-61500 in Rejetto HFS to bypass authentication and gain remote code execution, according to VulnCheck.
SecurityZimbra Flaw Exploited Before Disclosure
Microsoft says attackers probed and exploited a Zimbra command injection flaw in the window between patch release and public disclosure.
SecurityAI-Discovered Flaws Skew Toward RCE
Google's threat intelligence unit reports AI-found vulnerabilities are far more likely to enable remote code execution than other disclosed flaws.
SecurityWatchGuard Patches 15 Fireware OS Flaws
WatchGuard fixed a critical Fireware OS code injection flaw and 13 high-severity bugs, plus three Access Point vulnerabilities disclosed a day earlier.
SecurityF5 zero-day hits BIG-IP APM deployments
F5 patched a critical BIG-IP APM zero-day exploited in remote code execution attacks, as CISA ordered federal agencies to secure networks by Friday.
SecurityWordPress 7.1.2 Patches Critical LFI-to-RCE Flaw
WordPress fixed a critical flaw in versions 4.7.0 through 7.1.1 that can lead to code execution on servers lacking a page-prefixed theme folder and register_argc_argv off.
SecurityClick2Shell Turns Admin Clicks Into Theme Installs
A new WordPress core flaw lets a crafted link silently install a theme, and researchers chained it to full code execution.
Cyber CrimePlugin4Shell Exposes AI Coding Agents to RCE
A zero-click remote code execution flaw in popular AI coding agents could let attackers run malicious code without developer interaction, researchers warn.
SecurityUnbound DNSSEC Flaw Opens RCE Path
A heap overflow in Unbound's DNSSEC validator lets attackers who control a malicious DNS zone trigger remote code execution on vulnerable resolvers.
SecurityWooCommerce Plugin Flaw Fuels Web Shell Attacks
Attackers are exploiting a critical WooCommerce Wholesale Lead Capture vulnerability to upload PHP web shells and achieve remote code execution.
Cyber CrimeCisco Email Gateway Flaw Under Attack
Cisco warns CVE-2026-76461, a CVSS 9.8 flaw in Secure Email Gateway, is being exploited to run commands as root, with a federal patch deadline of September 17.
SecurityMarimo RCE Hit by Human at Machine Speed
Sysdig says a hand-built toolkit let a human operator exploit a Marimo flaw in eight seconds, without any sign of LLM use.
SecurityCheck Point's Patch Gap Leaves VPN Flaws Exposed
Two 9.8-rated certificate flaws in Check Point gateways carry fixes that some customers say they cannot access.
SecurityAndroid's Patch Flood Returns After Quiet Summer
Google's September 2026 Android updates fix 180 vulnerabilities, including 26 critical flaws, after two consecutive bulletins with no security fixes.
SecurityIvanti's Patch Cascade: Critical RCE Flaws Resolved
Ivanti addresses critical and high-severity vulnerabilities across Neurons for ITSM, Sentry, and EPMM, urging immediate updates.
SecurityVMware patches critical host-code execution flaw
Broadcom patched one critical and one high-severity VMware Workstation and Fusion vulnerability, both enabling host code execution.
SecurityPostgreSQL backup accounts open 12-year backdoor
A 12-year-old PostgreSQL flaw lets low-privilege replication accounts gain superuser access and remote code execution across platforms.
SecurityAI Exploits OT Equipment, But Not Cheaply
Forescout researchers used AI to port RCE exploits to PLCs, but high cost and effort still deter criminals.
SecurityModem Memory Flaw Opens Door to Kernel Takeover
UNISOC modem flaw lets attackers escalate code execution to kernel level via video calls.
SecurityUnauthenticated SAP Flaw Earns Maximum CVSS Score
SAP ships urgent patches for Commerce Cloud and other critical flaws rated up to 10.0.
SecurityCritical CodeIgniter File Upload Flaw Found
A critical vulnerability in CodeIgniter 4 allows attackers to bypass file validation, potentially leading to remote code execution on affected servers.
SecurityPaperclip Flaw Opens AI Agent Gateways
A critical authorization bypass in the Paperclip platform allowed attackers to execute arbitrary code with server-level permissions.
SecurityCritical Nuxt DevTools RCE Flaw Patched
An unauthenticated remote code execution vulnerability in Nuxt DevTools allows attackers to run arbitrary commands on developer machines via the HMR port.
SecurityFlowise Fixes Critical Root RCE Vulnerability
A critical remote code execution vulnerability in Flowise allows low-privileged attackers to gain root access on vulnerable servers via CSV Agent code injection.
SecurityFlowise Patches Critical CSVAgent RCE Flaw
A critical remote code execution vulnerability in Flowise's CSVAgent allows attackers to bypass python code filters using pandas read_pickle deserialization.