Vulnerabilities
Totolink X2000R Mcli Stack Overflow Grants Authenticated Remote Code Execution
A critical stack-based buffer overflow in the Mcli feature of this router allows authenticated attackers to run arbitrary code on the device.
remote code execution
Everything RedTeam Log has reported about remote code execution: 15 stories, newest first. Part of our Vulnerabilities coverage.
Vulnerabilities
PHP RCE flaws leak early: Teams urged to prep for Oct 21 patches amid 9.2 severity risk
Security teams urge immediate preparation for critical PHP updates after embargoed vulnerability details leak ahead of scheduled release.
Vulnerabilities
DrayTek Vigor2960 Command Injection Patch Released Amid Persistent Public Exploit Risk for End-of-Support Units
A critical remote code execution flaw in end-of-support DrayTek routers has been patched, but public exploits remain a risk for unupdated devices.
Vulnerabilities
Eptura Archibus Auth Bypass and RCE Vulnerabilities Grant Unauthenticated Database Access
Rapid7 found three vulnerabilities in Eptura Archibus allowing unauthenticated remote code execution and full database access.
Vulnerabilities
Eptura Archibus Critical Upload Bug Permits Server Command Execution Before 2025.02 Patch
Attackers can run server commands via uploaded files in Eptura Archibus versions before the 2025.02 update, exploiting a critical flaw rated 9.6 by NVD.
Vulnerabilities
H3C Magic NX15 OS Command Injection CVE-2026-112370: Public Exploit Code Fuels Critical RCE Threat
A critical OS command injection flaw in H3C Magic NX15 firmware allows remote exploitation, with public exploit code available for use.
Vulnerabilities
ELEX HelpDesk Plugin Permits Remote Code Execution via Unchecked File Uploads
Unauthenticated attackers can run arbitrary code on WordPress sites using the ELEX HelpDesk plugin, rated CVSS 9.8 by the NVD.
Vulnerabilities
Collabora Online CODE Server Restart Command Injection Enables Full System Control
Attackers exploited a command injection bug in the built-in server during restarts, gaining full control of affected Nextcloud systems.
Vulnerabilities
Snazzy Social Media Feed RCE Risk: Subscriber Access Triggers Critical Upload Flaw
Authenticated users with low-level access can execute code on sites using Snazzy Social Media Feed versions up to 2.5 via a missing security check.
Vulnerabilities
Windows DNS Heap Buffer Overflow Enables Critical Remote Code Execution
An unpatched flaw in Microsoft’s DNS service allows remote attackers to run code, rated critical with a CVSS score of 9.8.
Vulnerabilities
Microsoft Shell Bypass and Critical RCE Flaws in October 2026 Patch
Microsoft releases updates for 1,415 flaws including an exploited Windows Shell bypass and critical remote code execution vulnerabilities across its ecosystem.
Vulnerabilities
Adobe ColdFusion Input Validation Bug Risks Remote Code Execution Without User Action
A critical input validation flaw in Adobe ColdFusion allows attackers to run code on servers without any user action required.
Vulnerabilities
Adobe ColdFusion Critical Auth Error Permits Remote Code Execution in Versions 2023 and 2025
A critical authorization error in ColdFusion allows low-privileged attackers to run arbitrary code without interacting with users.
Vulnerabilities
Windows Message Queuing Vulnerability Enables Remote Code Execution Without Authentication on Multiple Versions
A critical vulnerability in Windows Message Queuing allows attackers to run code remotely without authentication, affecting multiple Windows versions.
Vulnerabilities
PaperCut MF: Four Flaws Allow Unauthenticated Remote Code Execution, Complicating Patching
Researcher discloses a series of flaws allowing attackers to take control of PaperCut systems without login credentials, complicating patching efforts.