#RCE

cyber.netsecops.io

Microsoft SharePoint RCE Vulnerability Now Actively Exploited

A critical remote code execution vulnerability in Microsoft SharePoint (CVE-2026-50522) is now actively exploited, allowing attackers to steal machine keys.

mastodon.in4matics.cat

Original post on mastodon.in4matics.cat

seclists.org

Full Disclosure: [KIS-2026-13] vBulletin <= 6.2.1 (runMaths) Remote Code Execution Vulnerability

securityonline.info

CVE-2026-64638: WordPress Pre-Auth XSS Flaw Can Escalate to Remote Code Execution

TL;DR WordPress 7.0.3 is out as a security release. This WordPress security update fixes about a dozen flaws. The most serious is CVE-2026-64638, a pre-auth cross-site scripting bug that can escalate to remote code execution. It scores 8.9. Update your sites right away. Why it matters WordPress powers a large share of the web. A pre-auth flaw needs no login to start.

opensocial.media

Original post on opensocial.media

securityonline.info

Cisco IMC Argument Injection Flaw CVE-2026-20200 Enables Root RCE, PoC Exploit Code Publicly Available

TL;DR Cisco disclosed two Cisco IMC vulnerabilities in the web-based management interface. The more serious one, CVE-2026-20200, scores 8.8 and allows root-level remote code execution. Cisco confirms that proof-of-concept exploit code is publicly available for it. Why it matters The IMC manages Cisco servers at a low level. A root compromise there gives deep control of the hardware. Per Cisco, the flaws could let an attacker "execute arbitrary commands on the underlying operating system" and "elevate privileges to root."

securityonline.info

CVE-2026-63077: TeamCity RCE Flaw Exploited in the Wild, CISA Warns

TL;DR CISA added the TeamCity vulnerability CVE-2026-63077 to its Known Exploited Vulnerabilities catalog. The flaw allows unauthenticated remote code execution on TeamCity On-Premises servers. Federal agencies must patch by August 8, 2026. Why This TeamCity Vulnerability Matters TeamCity runs build pipelines for thousands of software teams. Therefore, a server compromise can poison downstream code. A successful attack can expose stored credentials, alter server state, and taint build artifacts.

commons.now

1-Click RCE Flaw in Cursor, VS Code, and Google Antigravity Exposes 50M Developers to Cyberattacks

A critical one-click remote code execution (RCE) vulnerability affects three of the world’s most widely used code editors: Cursor, Microsoft VS Code, and Google Antigravity. The flaw, uncovered by AI…

securityonline.info

CVE-2026-70426: Critical Jenkins RCE Flaw Bypasses Deserialization Filter

TL;DR Jenkins patched a critical Jenkins vulnerability, CVE-2026-70426, that bypasses the JEP-200 deserialization filter. Attackers with Agent/Connect permission can run code on the controller. The August 5, 2026 advisory also fixes 22 other flaws. Why This Jenkins Vulnerability Matters The Jenkins controller is the brain of most CI/CD pipelines. Consequently, code execution there exposes source code, build secrets, and deployment credentials.