#rce
6 articles
CVE-2026-119977: RCE During WordPress Core Upgrades (CISA KEV)
WordPress Core versions 4.7 through 7.1.3 let an unauthenticated attacker execute code on the server during a core upgrade, through predictable web-accessible staging paths. CISA confirms active exploitation...
CVE-2026-49869: Authentication Bypass in Kestra OSS — One endsWith and Full RCE as Root
The authentication filter checked whether the path ended with /configs. Any API path ending in that word skips authentication - and Kestra ships with script execution plugins enabled by default...
CVE-2026-19295 and CVE-2026-19286: Remote Code Execution in IBM Langflow OSS
Two critical vulnerabilities in IBM Langflow OSS allow OS command execution in the server process - through a crafted flow and through an insufficiently protected public A2A endpoint...
CVE-2026-81934: Use-After-Free in Redis TLS Handling
A use-after-free in the tlsProcessPendingData() function handling the TLS pending-data list allows a remote, unauthenticated attacker to execute arbitrary commands with Redis server privileges...
CVE-2026-32998: Critical RCE in Veeam Service Provider Console and Backup & Replication
Critical RCE vulnerability in Veeam Service Provider Console (9.x < 9.2.0.33215) and Veeam Backup & Replication (13.x < 13.0.1.2067) - attackers can remotely execute code on backup management systems...
CVE-2026-42945: Critical RCE in NGINX ngx_http_rewrite_module (Public PoC Available)
Critical RCE vulnerability in NGINX ngx_http_rewrite_module present in source code since 2008 - heap buffer overflow in rewrite and set directive handling allows unauthenticated remote code execution...