SecurityClick2Shell Turns Admin Clicks Into Theme Installs
A new WordPress core flaw lets a crafted link silently install a theme, and researchers chained it to full code execution.
> Search
30 results for “code execution”
Security
Cyber CrimePlugin4Shell Exposes AI Coding Agents to RCE
A zero-click remote code execution flaw in popular AI coding agents could let attackers run malicious code without developer interaction, researchers warn.
SecurityUnbound DNSSEC Flaw Opens RCE Path
A heap overflow in Unbound's DNSSEC validator lets attackers who control a malicious DNS zone trigger remote code execution on vulnerable resolvers.
SecurityWooCommerce Plugin Flaw Fuels Web Shell Attacks
Attackers are exploiting a critical WooCommerce Wholesale Lead Capture vulnerability to upload PHP web shells and achieve remote code execution.
Cyber CrimeCisco Email Gateway Flaw Under Attack
Cisco warns CVE-2026-76461, a CVSS 9.8 flaw in Secure Email Gateway, is being exploited to run commands as root, with a federal patch deadline of September 17.
SecurityMarimo RCE Hit by Human at Machine Speed
Sysdig says a hand-built toolkit let a human operator exploit a Marimo flaw in eight seconds, without any sign of LLM use.
SecurityCheck Point's Patch Gap Leaves VPN Flaws Exposed
Two 9.8-rated certificate flaws in Check Point gateways carry fixes that some customers say they cannot access.
SecurityAndroid's Patch Flood Returns After Quiet Summer
Google's September 2026 Android updates fix 180 vulnerabilities, including 26 critical flaws, after two consecutive bulletins with no security fixes.
SecurityIvanti's Patch Cascade: Critical RCE Flaws Resolved
Ivanti addresses critical and high-severity vulnerabilities across Neurons for ITSM, Sentry, and EPMM, urging immediate updates.
SecurityVMware patches critical host-code execution flaw
Broadcom patched one critical and one high-severity VMware Workstation and Fusion vulnerability, both enabling host code execution.
SecurityPostgreSQL backup accounts open 12-year backdoor
A 12-year-old PostgreSQL flaw lets low-privilege replication accounts gain superuser access and remote code execution across platforms.
SecurityAI Exploits OT Equipment, But Not Cheaply
Forescout researchers used AI to port RCE exploits to PLCs, but high cost and effort still deter criminals.
SecurityModem Memory Flaw Opens Door to Kernel Takeover
UNISOC modem flaw lets attackers escalate code execution to kernel level via video calls.
SecurityUnauthenticated SAP Flaw Earns Maximum CVSS Score
SAP ships urgent patches for Commerce Cloud and other critical flaws rated up to 10.0.
SecurityCritical CodeIgniter File Upload Flaw Found
A critical vulnerability in CodeIgniter 4 allows attackers to bypass file validation, potentially leading to remote code execution on affected servers.
SecurityPaperclip Flaw Opens AI Agent Gateways
A critical authorization bypass in the Paperclip platform allowed attackers to execute arbitrary code with server-level permissions.
SecurityCritical Nuxt DevTools RCE Flaw Patched
An unauthenticated remote code execution vulnerability in Nuxt DevTools allows attackers to run arbitrary commands on developer machines via the HMR port.
SecurityFlowise Fixes Critical Root RCE Vulnerability
A critical remote code execution vulnerability in Flowise allows low-privileged attackers to gain root access on vulnerable servers via CSV Agent code injection.
SecurityFlowise Patches Critical CSVAgent RCE Flaw
A critical remote code execution vulnerability in Flowise's CSVAgent allows attackers to bypass python code filters using pandas read_pickle deserialization.
SecurityMaxSite CMS Critical RCE Flaw Discovered
A critical remote code execution vulnerability in MaxSite CMS allows unauthenticated attackers to inject malicious PHP code into configuration files.
SecurityCritical RCE Flaw Found in Kotaemon 0.12.0
An unauthenticated remote code execution vulnerability in Kotaemon allows attackers to run arbitrary system commands by exploiting insecure deserialization.
SecurityCritical Command Injection Hits Puwell Cameras
Puwell IP cameras running firmware versions 2.x through 4.x are vulnerable to unauthenticated remote code execution via a flaw in the DebugShell interface.
SecurityCritical Adobe Campaign Classic Flaw Found
A critical template engine vulnerability in Adobe Campaign Classic allows for unauthenticated remote code execution with a maximum CVSS score of 10.
SecurityCritical RCE Flaw Found in OpenEMR 8.2.0
A critical remote code execution vulnerability in OpenEMR allows authenticated administrators to run arbitrary OS commands via the document category tree.
SecurityRails Vulnerability Risks Remote Access
A critical flaw in the Active Storage framework allows for unauthorized file access and potential remote code execution.
SecurityCritical ArcadeDB Flaw Allows Code Execution
A severe authorization bypass in ArcadeDB allows unauthenticated users to execute arbitrary JavaScript, earning a critical 9.8 CVSS severity rating.
SecurityCritical NocoBase RCE Vulnerability Found
A severe SQL injection flaw in NocoBase allows unauthenticated attackers to gain remote code execution via a simple registration and API request.
SecurityCritical RCE Flaw Found in Azure Cosmos DB
A critical vulnerability in Azure Cosmos DB allows unauthorized remote code execution, earning a maximum CVSS score of 10.
SecurityCritical SiYuan Desktop Flaw Enables RCE
A critical vulnerability in SiYuan desktop allows attackers to achieve remote code execution through a malicious deep link, necessitating an immediate update.
SecurityRedis Patches Zero-Days Found by AI
Researchers used AI agents to uncover remote code execution vulnerabilities in Redis, prompting seven urgent security releases.