Vulnerabilities
Argo CD Kustomize Injection Bug Lets Read-Only Users Run Code on Repo Servers
Attackers with read-only access to applications can execute commands on Argo CD repo servers by injecting git options through Kustomize files.
Remote Code Execution
Everything RedTeam Tribune has reported about Remote Code Execution: 15 stories, newest first. Part of our Vulnerabilities coverage.
Vulnerabilities
Vulnerabilities
PHP Remote Code Execution Flaws Rated 9.2 Trigger Emergency Patch Plan
PHP teams prepare for critical updates addressing two unconfirmed RCE vulnerabilities with a 9.2 CVSS score, targeting supported branches only.
Vulnerabilities
PHP RCE flaws at 9.2 CVSS severity prompt emergency patches for October 21 after WatchTowr confirms leaks
Leaked details of two critical PHP vulnerabilities lead maintainers to schedule emergency patches for October 21.
Vulnerabilities
DB-GPT 0.8.2 Endpoint Error Grants Unauthenticated Root Code Execution
A flaw in DB-GPT 0.8.2 allows attackers to run code as root without login, exposing containers and databases to full compromise.
Vulnerabilities
SGLang Arbitrary Code Execution Vulnerability in Unauthenticated Dumper Endpoint Affects 0.5.10-0.5.22
Attackers can run arbitrary Python code in the scheduler by exploiting a code injection flaw in unauthenticated SGLang endpoints.
Vulnerabilities
Server-Side Template Injection: Definition, Risks, and Mitigation
Server-side template injection allows attackers to execute arbitrary code by manipulating the data that populates your application’s user interface templates.
Vulnerabilities
Wavlink WL-WN530BE2-A Router Exposed to Remote Code Execution via Login Handler
Attackers could execute arbitrary commands remotely on this router by exploiting a flaw in how login requests process client addresses.
Vulnerabilities
Spot Unsafe YAML Deserialization: Warning Signs and Fixes
Unsafe YAML deserialization allows attackers to execute arbitrary code by injecting objects that the parser treats as executable instructions rather than data.
Vulnerabilities
Printcart Store: Arbitrary File Upload Bug Lets Attackers Write Executables to WooCommerce Servers Without Credentials
Attackers can write executable files to WooCommerce servers without credentials in Printcart Store versions up to 2.9.1.
Vulnerabilities
.NET WPF Out-of-Bounds Write in CVE-2026-70007 Allows Remote Code Execution
Microsoft patches high-severity heap corruption flaw in .NET WPF runtime that enables remote attackers to execute code via crafted pixel-shader bytecode.
Vulnerabilities
CVE-2026-106621 Enables Arbitrary Code Execution in Adobe ColdFusion Without User Interaction
A critical code injection flaw in Adobe ColdFusion allows remote attackers to run arbitrary code without needing victim interaction.
Vulnerabilities
Microsoft QUIC Use-After-Free Flaw Enables Remote Code Execution on Windows 11
An unauthorized attacker can execute code over a network via a critical use-after-free vulnerability in the Microsoft QUIC protocol on multiple Windows 11 versions.
Vulnerabilities
Why is insecure deserialization dangerous: The hidden execution risk
Insecure deserialization allows attackers to execute arbitrary code by tricking applications into loading crafted data structures as active objects.
Vulnerabilities
OpenSpug Spug File Transfer Component Suffers Critical Remote Command Injection
NVD rates CVE-2026-108540 as critical due to remote OS command injection in OpenSpug Spug up to version 4.0.1, with no vendor response.
Vulnerabilities
3D Product Configurator: Unauthenticated RCE via xpv_image Affects expivi <=2.16.2
A critical flaw in the 3D Product Configurator plugin allows unauthenticated attackers to execute arbitrary code on WordPress servers via a single POST request.