Rce

vulnerabilities 2026-11-12
N-able N-central Under Siege: 4EverAble2Shell and Agent2Shell Bypass Hotfix 2 Days After the Able2Shell Zero-Day Dump
A researcher's Able2Shell dump of 33 alleged N-central zero-days forced N-able to take its hosted RMM cloud offline; new 4EverAble2Shell (root RCE) and Agent2Shell (SYSTEM on managed Windows endpoints) chains reportedly defeat the November 10 Hotfix 2.
zero-day active-exploitation rce privilege-escalation authentication-bypass supply-chain
vulnerabilities 2026-11-06
CVE-2026-109518: APT Retry Logic Lets On-Path Attackers Swap a Verified Package and Run Code as Root
A flaw in APT's download retry and hard-link handling lets a network attacker replace a package after signature verification, yielding root code execution on Debian and Ubuntu. Patches are out.
linux debian ubuntu package-manager rce man-in-the-middle
vulnerabilities 2026-11-05 Critical
Zyxel GS1900 Zero-Day CVE-2026-107441 Bypassed the CVE-2026-7273 Patch and Hit Nearly 1,000 Switches
Binarly found that attacks on ~1,000 Zyxel GS1900 switches used a separate CGI out-of-bounds write, CVE-2026-107441, that defeats the earlier CVE-2026-7273 fix; Zyxel's new firmware is out.
zero-day active-exploitation network-appliance cisa-kev rce memory-corruption
vulnerabilities 2026-11-04
Siemens SIMATIC IoT2050 CVE-2026-58115: Unauthenticated Node-RED Editor Exploited to Drop Linux Bots and Persistent Webshells
VulnCheck reports in-the-wild exploitation of CVSS 10.0 CVE-2026-58115, where Siemens SIMATIC IoT2050 Advanced gateways expose an unauthenticated Node-RED editor, since October 30.
active-exploitation rce authentication-bypass ics iot linux
vulnerabilities 2026-11-04
WordPress Core CVE-2026-119977: Upgrade-Window Race Condition Gives Unauthenticated RCE, Added to CISA KEV
CISA added WordPress Core's CVE-2026-119977, a TOCTOU race in the full-package upgrade process affecting 4.7 through 7.1.3, to KEV on November 3; federal agencies must patch to 7.1.4 by November 6.
active-exploitation cisa-kev rce cms wordpress
vulnerabilities 2026-10-31
EDK II PXE Flaw (CVE-2026-97631): One Oversized ICMP Error Corrupts Server Firmware Before the OS Loads
A CVSS 9.5 buffer overflow in TianoCore EDK II's PXE driver lets an unauthenticated network attacker corrupt memory in the DXE phase of a booting server, ahead of Secure Boot and any OS controls.
uefi firmware rce network-boot pxe bare-metal
vulnerabilities 2026-10-30
CVE-2026-98432: Linux Kernel IPv4 TCP Use-After-Free Rated CVSS 9.8, Reachable Before Application Authentication
A race in the Linux kernel's IPv4 TCP handshake path frees socket options while still in use, giving an unauthenticated remote peer a use-after-free against any listening TCP service. Fixed in stable kernels; distro status varies.
linux linux-kernel rce cloud container-escape
vulnerabilities 2026-10-26 Critical
Broccoli2Shell: CVE-2026-111497 Brotli Decoder Out-of-Bounds Write Gives RCE in Node.js
A CVSS 9.2 out-of-bounds write in Google's Brotli decoder (CVE-2026-111497) lets crafted compressed data corrupt memory in Node.js and other consumers; public PoCs exist and Node.js shipped fixes October 21.
rce memory-corruption nodejs web-server open-source proof-of-concept
vulnerabilities 2026-10-25
SiteGuard WAF CVE-2026-106931: Exploited Command Injection Gives Root/SYSTEM, and Patching Can Erase the Evidence
EG Secure Solutions' SiteGuard Server Edition WAF has an exploited OS command injection in its default-on statistics feature; CISA added it to KEV and the vendor says to save diagnostics before patching.
active-exploitation cisa-kev command-injection waf network-appliance rce
vulnerabilities 2026-10-23
CVE-2026-110264: CVSS 10 Unauthenticated RCE in Self-Managed GitLab Reaches Back to Version 7.0
GitLab patched a maximum-severity unauthenticated code-execution flaw in self-managed CE and EE, caused by an integer overflow in regex compilation and present in every release since 2014.
rce cicd gitlab integer-overflow source-control patch-now
vulnerabilities 2026-10-22
Two CVSS 9.0 Linux KSMBD RCE Flaws Hit a Public Mailing List Before Any Kernel Fix Existed
Trend Micro ZDI reports for two CVSS 9.0 KSMBD flaws, one pre-authentication, were mistakenly posted to the public Linux kernel list with no mainline fix and no CVE assigned.
linux-kernel linux rce smb zero-day disclosure
vulnerabilities 2026-10-21 Critical
PHP2Shell: Leaked CVE-2026-109618 and CVE-2026-109619 Give Unauthenticated RCE in the PHP Engine
Two CVSS 9.2 flaws in the PHP engine leaked ahead of coordinated disclosure; PHP shipped emergency releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as exploit attempts appeared.
rce php zero-day active-exploitation web-server memory-corruption
vulnerabilities 2026-10-20
Unpatched Broadcom WPS Flaw Gives Radio-Range Root on ISP Gateways, No Password Required
Researcher Quentin Kaiser showed at Hexacon that Broadcom's proprietary Wi-Fi Protected Setup code can be corrupted by crafted packets, giving an attacker in radio range root code execution on home gateways with no Wi-Fi password. No CVE has been assigned.
network-appliance rce unpatched firmware wireless zero-day
vulnerabilities 2026-10-20
Plex2Shell: Four-CVE Plex Media Server Chain Exploited Within a Day of PoC Release, Dropping XMRig and Proxy Malware
A public exploit chain for Plex Media Server (CVE-2026-96652, -96654, -96655, -96656) goes from SSRF to code execution; attackers began dropping XMRig and a proxy tool less than 24 hours after the PoC appeared.
active-exploitation rce ssrf linux cryptomining container
vulnerabilities 2026-10-18 Critical
Nextcloud Built-in CODE Server CVE-2026-110447: Unauthenticated Command Injection Exploited for Webshells Since September
A critical OS command injection in the Collabora-based built-in CODE server app for Nextcloud (richdocumentscode) has been exploited in the wild since about September 10; the CVE was published October 14, over a month after the patch.
active-exploitation command-injection rce web-shell cloud authentication-bypass
vulnerabilities 2026-10-15
Cisco Secure Email Gateway CVE-2026-76519: Unauthenticated Root File Write via AMP Exploited in the Wild
Cisco confirms in-the-wild exploitation of CVE-2026-76519, a CVSS 9.8 path traversal in Secure Email Gateway's AMP File Reputation that lets unauthenticated attackers write files and run commands as root.
active-exploitation cisa-kev rce path-traversal network-appliance email-security cisco
vulnerabilities 2026-10-15
Palo Alto PAN-OS CVE-2026-0322: Management Interface Code Injection Gives Root on Firewalls, Exploited as Zero-Day
Palo Alto Networks patched CVE-2026-0322, a code injection flaw in the PAN-OS management interface that lets an authenticated attacker run code as root; limited exploitation observed and CISA has added it to KEV.
palo-alto pan-os zero-day active-exploitation cisa-kev rce network-appliance
vulnerabilities 2026-10-14
CVE-2026-97229: Maximum-Severity Integer Overflow in GitLab's CI/CD Regex Compiler Allows Code Execution
GitLab patched a CVSS 10.0 integer overflow in the CI/CD regular expression compiler that lets a crafted pipeline expression execute code on self-managed servers.
cicd rce gitlab supply-chain memory-corruption devops
vulnerabilities 2026-10-07
CVE-2026-61500: Rejetto HFS Predictable Session Key Gives Unauthenticated Admin and RCE, Probed Within a Day
Rejetto HFS 3.x signs sessions with a key derived from Math.random() and leaks its outputs at login, letting unauthenticated attackers forge admin sessions and run server-side JavaScript; scanning from China began October 1.
active-exploitation authentication-bypass rce ai-discovered file-server
vulnerabilities 2026-10-04
AhsayCBS CVE-2026-105134: Unauthenticated OS Command Injection (CVSS 10) in Backup Server
A CVSS 10 OS command injection in the AhsayCBS Replication Receiver endpoint allows unauthenticated remote code execution on backup servers up to 10.3.2. Upgrade to 10.3.4.
rce command-injection backup authentication-bypass ransomware