Rce
Curated coverage and analysis in this editorial area.
NGINX Rift and Fragnesia: Two Critical Flaws at the Heart of Internet Infrastructure
An 18-year-old heap overflow hits nearly 19 million NGINX servers with unauthenticated RCE, while a local Linux exploit corrupts the p…
GStreamer RCE Flaw in rtpsbcdepay Codec: Patch Available
ZDI-26-467 (CVE-2026-18299) details a use-after-free in GStreamer's RTP SBC depayloader enabling remote code execution. The primary ri…
SSRF in Phoenix Contact MQTT Broker: The Assault on EV Chargers Starts Here
ZDI-26-518 reveals a flaw in the MQTT service of Phoenix Contact CHARX SEC-3150 EV chargers. An unauthenticated, network-adjacent atta…
Aeon RCE via Pickle Dataset: ML Pipeline Risk
CVE-2026-18285: The Python library Aeon executed arbitrary code through pickle deserialization of seemingly legitimate datasets. The b…
Heimdall Data Database Proxy: Root RCE via Directory Traversal in uploadJar
ZDI-26-479 reveals a critical flaw in the uploadJar method of Heimdall Data Database Proxy. An authenticated attacker can achieve arbi…
WordPress wp2shell: In-the-Wild RCE Within 24 Hours of AI-Assisted Discovery
The wp2shell vulnerability chain in WordPress Core is under active in-the-wild exploitation with pre-authentication RCE. Wiz Research…
Apple Patches ImageIO: Parsing Bug Opens Door to RCE Across Eight Operating Systems
A flaw in Apple's ImageIO framework allows remote code execution via malformed image files. Patches are available for eight operating…
Adobe Campaign Classic: Critical CVSS 10.0 Patch for On-Premise Deployments
Adobe has fixed CVE-2026-48449, a maximum-severity vulnerability in Campaign Classic that allows unauthenticated remote code execution…
Splunk Enterprise Critical Zero-Day Enables Pre-Auth RCE: When the SIEM Becomes the Entry Point
CVE-2026-20253 hits Splunk Enterprise with a CVSS 9.8 score. The pre-authentication vulnerability in the PostgreSQL sidecar service ea…
7-Zip: The Patch Existed, But No One Installs It Without Auto-Update
CVE-2026-14266 has affected 7-Zip's XZ decompressor for five years. The fix shipped on June 25, but without automatic updates, the vas…
Aeon RCE Flaw in Benchmark Loading: The Risk Lies in the Datasets
Trend Micro's Zero Day Initiative published advisory ZDI-26-470 assigning CVE-2026-18287 to a code injection vulnerability in the Pyth…
GIMP: APNG Integer Overflow Enables Code Execution, Patch Released
An integer overflow in GIMP's APNG parser allows remote arbitrary code execution when a user opens a malicious file. Tracked as CVE-20…