Advertisement
CVE-2015-3306: ProFTPD Improper Access Control Exploitation
Critical improper access control vulnerability in ProFTPD (CVE-2015-3306) allows remote file manipulation, actively exploited.
CVE-2021-3199: ONLYOFFICE Docs RCE via Path Traversal
Actively exploited path traversal vulnerability [CVE-2021-3199] in ONLYOFFICE Docs Server enables remote code execution when JWT is used. Immediate patching is critical.
Cisco Patches 35 Vulnerabilities: Critical Flaws in Meraki, NX-OS
Cisco released patches for 35 vulnerabilities, including multiple critical issues in Meraki, License On-Prem, NX-OS, and APIC products.
CVE-2026-61500: Rejetto HFS RCE via Weak Signing Key Flaw
Hackers are actively scanning for a critical RCE flaw in Rejetto HFS versions 3.0.0-3.2.0 (CVE-2026-61500), enabling session forgery and account takeover.
SWIFT & Government Middleware RCE Risk
Critical RCE vulnerabilities in middleware used by SWIFT banking and government sectors enable hardware-based MFA exploits. Immediate patching is vital.
CVE-2026-75650: Adobe Commerce RCE via Template Engine Flaw
CISA warns of active exploitation of CVE-2026-75650, a critical RCE vulnerability in Adobe Commerce and Magento Open Source platforms.
Advertisement
Zero-Day Exploitation: StyleSmuggler RCE in Magento, Adobe Commerce
Attackers are exploiting an unpatched zero-day (StyleSmuggler) in Magento Open Source and Adobe Commerce for unauthenticated RCE, installing backdoors.
SonicWall SMA 1000 Zero-Days: Unauthenticated RCE Explained
Zero-day vulnerabilities in SonicWall SMA 1000 series appliances enable unauthenticated remote code execution, posing critical risks to organizations.
Chrome Zero-Day CVE-2026-85046 Actively Exploited: Patch Now
Google released an urgent update for a critical Chrome zero-day, CVE-2026-85046, actively exploited in V8 engine type confusion attacks.
WordPress RCE Exploited via CVE-2026-14894 & CVE-2026-32475
Attackers exploit critical RCE flaws in WordPress Super Forms (CVE-2026-14894) and Elementor Pro (CVE-2026-32475) to deploy web shells and seize sites.
Critical Type Confusion in isolated-vm Leads to Host RCE
A critical type confusion vulnerability in the Node.js isolated-vm library allows remote code execution on the host system via V8 Isolates.
CVE-2025-62593: Ray-Project Ray RCE Exploited In Wild
CISA confirms active exploitation of CVE-2025-62593, a critical code injection vulnerability in Ray-Project Ray allowing remote code execution. Developers are targeted.
CVE-2026-58231: SAP Commerce Cloud Unauthenticated RCE Flaw
SAP has patched a critical flaw, CVE-2026-58231, in Commerce Cloud Data Hub Adapter allowing unauthenticated arbitrary code execution. Immediate action is urged.
RCE Vulnerabilities in Copeland XWEB Pro & Danfoss AK-SM 800A Controllers
Claroty Team82 discovered multiple RCE vulnerabilities in Copeland XWEB Pro and Danfoss AK-SM 800A commercial refrigeration controllers.
CVE-2026-59310: vCenter RCE Exploited for Reverse SSH Access
A critical RCE flaw, CVE-2026-59310, in VMware vCenter Syslog Server is under active exploitation, enabling reverse SSH for persistence.
Belgium eID Authentication RCE via Browser Extension Flaws
Severe vulnerabilities in a key browser extension fully compromised Belgium's eID authentication trust framework, exposing citizen accounts to remote code execution.
Microsoft & Apple Patch Critical RCEs and Auth Bypass Flaws
Microsoft released patches for critical-severity RCE and EoP flaws across Active Directory, Azure, and Teams. Apple fixed a Screen Sharing authentication bypass.
Critical Backdoors & Supply Chain Attacks: Zbtlink Routers & QuickFox VPN Compromised
Urgent warning: Zbtlink routers ship with unauthenticated root backdoors, while QuickFox VPN delivers FDMTP implant via supply chain compromise.
CVE-2026-64638: WordPress Pre-Auth XSS Leads to PHP RCE
A pre-authentication reflected XSS (CVE-2026-64638) in WordPress can be chained for PHP code execution. Patch immediately.
Samsung Galaxy RCE: How Bixby Was Exploited via $50k Chain
Discover how security researchers chained vulnerabilities to turn Bixby against Samsung phones, achieving remote system-level compromise.
CVE-2026-60137: WordPress Core SQL Injection to RCE — Patch Now
CISA warns of active exploitation for CVE-2026-60137, a WordPress Core SQL Injection vulnerability chaining to RCE for unauthenticated attackers.
Rails Active Storage RCE via Critical Flaw — Patch Now
A critical flaw in Rails Active Storage permits unauthenticated attackers to read arbitrary files and potentially achieve remote code execution.
Ruflo MCP Bridge Command Execution: Mitigation Guide
Unauthenticated attackers can exploit a critical vulnerability in Ruflo to execute commands in the MCP bridge container and spawn rogue AI swarms.
CVE-2026-66066: Unauthenticated File Read in Rails Active Storage
Unauthenticated attackers can exploit CVE-2026-66066 in Ruby on Rails Active Storage to read sensitive server files, potentially leading to full compromise.