Vulnerabilities
Argo CD Kustomize Flaw Enables Critical RCE on Repo Servers; Patches Available
A flaw in Argo CD allows attackers to run commands on repo servers via crafted Kustomize files, with patches now available for affected versions.
Remote Code Execution
Everything Vuln Post has reported about Remote Code Execution: 24 stories, newest first. Part of our Vulnerabilities coverage.
Vulnerabilities
Vulnerabilities
PHP Critical RCE Flaws Prompt Emergency Patch for Supported Versions
PHP issues urgent security update for two remote code execution flaws rated 9.2, affecting only actively supported branches.
Vulnerabilities
Totolink X2000R IPv6 Config Buffer Overflows Enable Authenticated Remote Code Execution
Multiple buffer overflows in the X2000R’s IPv6 configuration allow authenticated attackers to run arbitrary code on the device.
Vulnerabilities
Advantech ADAM-3600 Patch Fixes Remote Code Execution Flaw CVE-2026-43857
A high-severity vulnerability in the ADAM-3600 allows authenticated attackers to run arbitrary code with service privileges. Version 2.8.5.0 resolves the issue.
Vulnerabilities
Eptura Archibus Critical RCE: Unauthenticated Attackers Can Control Servers via Rapid7-Found Flaw
Rapid7 found three vulnerabilities in the facility management platform, including a critical remote code execution flaw that allows unauthenticated attackers to take control of servers.
Vulnerabilities
Apache Camel JGroups Deserialization Bug CVE-2026-88900 Enables RCE, Patches Now Available
A high-severity deserialization flaw in Apache Camel’s JGroups component enables remote code execution. Patches are available for supported versions.
Vulnerabilities
DB-GPT 0.8.2 Critical Flaw Allows Unauthenticated Remote Code Execution
A critical vulnerability in DB-GPT through version 0.8.2 lets attackers run code as root without authentication, exploiting a mock admin role function.
Vulnerabilities
Plex Media Server RCE Chain Deploys Cryptominers on Unpatched Systems
Attackers are chaining four flaws in Plex Media Server to execute code remotely, deploying cryptominers and proxy software on unpatched systems.
Vulnerabilities
Mercury RCE Bug in Pre-3.2.6 Lets Attackers Run Python Code on Tokenless Servers
A critical flaw in Mercury versions before 3.2.6 lets anonymous users run arbitrary Python code on servers configured without authentication tokens.
Vulnerabilities
Craft CMS Twig Filter Flaw Allows Remote Code Execution
Authenticated users can exploit a missing guard in Craft CMS to write webshells, affecting versions prior to 4.18.8 and 5.11.0.
Vulnerabilities
LMCache Unauthenticated RCE Flaw in Multiprocess Mode Affects Versions Before 0.5.6
A critical remote code execution flaw in LMCache allows unauthenticated attackers to run code via Pickle deserialization in distributed deployments.
Vulnerabilities
GitLab CI/CD Integer Overflow Enables Unauthenticated RCE in CVE-2026-97229
GitLab releases patches for a critical integer overflow in CI/CD regular-expression handling that allows unauthenticated remote code execution on affected instances.
Vulnerabilities
Markdown Preview Enhanced Fixes Remote Code Execution in VS Code Extension
A high-severity command injection flaw in the Markdown Preview Enhanced extension allows attackers to run system commands via crafted links, now patched in version 0.8.28.
Vulnerabilities
iOS Zero-Click Vulnerabilities Explained for Beginners
Zero-click exploits allow attackers to compromise your device without you opening a link or touching the screen, bypassing standard user interaction defenses.
Vulnerabilities
Windows Media Video Decoder Heap Buffer Overflow CVE-2026-100220 Demands Urgent Patching for Windows 10/11 Users
A high-severity flaw in the Windows Media Video Decoder allows remote code execution. Affected Windows 10 and 11 versions require immediate updates.
Vulnerabilities
.NET WPF Runtimes: Unsafe Deserialization Flaw in Versions 8-11 Patched to Stop RCE
Microsoft has released updates for .NET WPF runtimes to fix a high-severity remote code execution vulnerability caused by unsafe data deserialization.
Vulnerabilities
Microsoft .NET WPF RCE Flaw CVE-2026-70174 Patches XPS Link Bypass
High-severity remote code execution in .NET WPF allows attackers to run code via malicious XPS hyperlinks. Patches are available for versions 8 through 11.
Vulnerabilities
Printcart Store Plugin Unauthenticated RCE Flaw Affects Versions Through 2.9.1
A critical vulnerability in the Printcart Store WooCommerce plugin allows attackers to execute code remotely without logging in, affecting all versions up to 2.9.1.
Vulnerabilities
Adobe ColdFusion Authorization Flaw CVE-2026-106612 Enables Remote Code Execution
A critical authorization bypass in Adobe ColdFusion 2023 and 2025 allows low-privileged attackers to execute code without user interaction.
Vulnerabilities
Adobe ColdFusion Authorization Bypass CVE-2026-75994 Triggers Urgent Patch for 2023/2025 Versions
A critical authorization flaw in Adobe ColdFusion lets attackers run code without user interaction. Teams must patch versions 2025.0.13 and 2023.0.25 immediately.
Vulnerabilities
Unauthenticated RCE Mistakes: 7 Errors That Expose Your Systems
Default configurations and implicit trust assumptions create silent pathways for unauthenticated remote code execution that bypass standard perimeter defenses.
Vulnerabilities
Wazuh Arbitrary File Overwrite in MasterHandler Yields Root RCE for CVE-2026-74040
A critical vulnerability in Wazuh manager versions prior to 4.14.8 allows compromised cluster workers to overwrite configuration files and gain root execution.
Vulnerabilities
Square Squash Unsafe YAML Processing Enables Critical Unauthenticated Ruby RCE in CVE-2026-109391
A critical vulnerability in Square Squash allows attackers to execute arbitrary Ruby code via unsafe YAML processing on the symbolication API endpoint.
Vulnerabilities
Citrix NetScaler ADC and Gateway face critical RCE risk; patches required for 9.5-severity flaw
Citrix urges immediate patching for a new 9.5-severity remote code execution flaw affecting NetScaler ADC and Gateway appliances, though exploitation status remains unconfirmed.