Public Exploit Released for Patched vBulletin Pre-Auth Code Execution Flaw CVE-2026-61511
A public exploit has been released for a pre-authentication remote code execution vulnerability in vBulletin, tracked as CVE-2026-61511. The flaw resides in…
Tag: remote code execution
n8n Sandbox Escape Vulnerability Allows OS Command Execution via Workflow Editor
n8n has patched a high-severity expression-sandbox escape vulnerability that allows authenticated workflow editors to execute operating-system commands on the server running the…
CVE-2026-27577: Critical n8n Sandbox Escape
A critical sandbox escape vulnerability in n8n that allowed authenticated workflow editors to execute OS commands. Fixed in February 2026 with a…
Fastjson 1.x RCE Vulnerability Under Active Attack With No Patch Available
Security firms ThreatBook and Imperva report active exploitation of a critical remote code execution vulnerability in Alibaba's Fastjson 1.x JSON library for…
CVE-2026-16723: Alibaba Fastjson Remote Code Execution
A critical unpatched vulnerability in Alibaba Fastjson library (versions 1.2.68-1.2.83) with CVSS 9.0, allowing remote code execution without user interaction. Developers urged…
Cl0p Affiliates Exploit PTC Windchill and FlexPLM Flaws in Data Extortion Campaign
Threat actors linked to the Cl0p ransomware group are actively exploiting vulnerabilities in internet-exposed PTC Windchill and FlexPLM deployments as part of…
Bing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft’s Servers
A crafted SVG submitted to Bing's image search ran commands as NT AUTHORITYSYSTEM on Microsoft's production image-processing workers, and as root on…
CVE-2016-3714: ImageMagick Delegate Command Injection (ImageTragick)
A critical command injection vulnerability in ImageMagick's delegate mechanism allows remote code execution via crafted image files. This 2016 vulnerability is the…
HiveCmd.jar Malicious Java Add-on
A malicious Java user-defined function (UDF) for Apache Hive that allows remote code execution on HiveServer2. The attacker deployed it against the…
Kimi K3 AI Agents Discover Multiple Redis Zero-Days and Build RCE Exploit Chains
On July 23, 2026, Redis shipped seven security releases after researchers published authenticated remote code execution (RCE) proof-of-concept (PoC) exploits for stock…