CWE-94 - Code Injection

CISA Warns of Exploited Vulnerabilities in ProFTPD, ONLYOFFICE, Strapi, and More

Critical RCE Vulnerability in N-able N-central Requires Immediate Patching

Critical RCE Vulnerability in IBM Langflow Under Active Exploitation

Head Mare Hackers Exploit TrueConf Vulnerabilities to Deploy Backdoors

Critical SSTI Vulnerability in FOSSBilling Exposes Databases to RCE Attacks

Critical RCE Vulnerability in Langflow's Code Validation Endpoint

Critical Vulnerabilities in Veeam Software Expose Systems to Remote Attacks

Cloud Atlas APT Targets Russia and Belarus with New Tools and Techniques

Critical Vulnerability in Notepad++ Allows DoS and Memory Disclosure

JFrog Artifactory Vulnerabilities Enable Rapid Admin Access Exploitation

Critical Code Injection Vulnerability in Realtyna Organic IDX Plugin Disclosed

Multiple CVEs Exploited in Cybersecurity Threats: September 2026

Active Exploitation of Magento Zero-Day and Chromium Backdoors

Critical Vulnerabilities in perl-DBI Affecting SUSE Systems

Critical SQL Injection and XSS Vulnerabilities in RoundcubeMail Affect Fedora Users

Cisco Unity Connection Vulnerabilities Enable Code Execution and SSRF Attacks

Anonymous Researcher Publishes Zero-Day Exploits for Major Software Projects

Multiple CVEs in Python 3.15 Affect Fedora Users

Multiple Vulnerabilities in cPanel & WHM Posed Security Risks

Multiple Critical Vulnerabilities in ImageMagick Affecting Mageia and SUSE Systems

Malaysian Government Websites Targeted by Cyberattacks Exploiting Joomla Vulnerability

Nuxt Security Vulnerabilities Require Immediate Attention

Critical vBulletin RCE Flaw Exposes Forum Servers to Unauthenticated Attacks

Urgent CVE-2021-3199 Vulnerability in ONLYOFFICE Exploited in the Wild

Critical Vulnerabilities in SolarWinds Serv-U Require Immediate Patching

Critical Gitea Vulnerability CVE-2026-60004 Actively Exploited

Langflow CVE-2026-33017 Exploited for AWS Key Theft and Botnet Deployment

Critical Zero-Day Vulnerabilities in Atlassian Confluence Exploited

Active Exploitation of Critical Vulnerabilities in Lantronix and Ubiquiti Devices

Critical Use After Free Vulnerabilities in Fedora Chromium Update

Critical RCE Vulnerability in Ubuntu 24.04 LTS Wheel Package

Critical RCE Vulnerabilities in GitLab and Dell; Warlock Ransomware Targets SharePoint

Critical Vulnerabilities in Fedora 44 NGINX Modules Require Immediate Attention

Tails 7.6.2 Emergency Update Fixes Critical Flatpak Vulnerability

Critical Vulnerabilities in Fedora Chromium Browser Affecting Multiple Versions

Critical Security Flaws in cpp-httplib Affect Fedora Systems

September 2026 Security Update: Major CVEs from Adobe and Microsoft

Critical RCE Vulnerabilities in Cursor IDE Enable Zero-Click Prompt Injection Attacks

Exploitation of PaperCut Vulnerabilities Threatens Educational Institutions

CISA Adds Critical Vulnerabilities in PAN-OS, Cisco, and Ahsay to KEV Catalog

Attackers Exploit CVE-2026-39987 to Deploy NKAbuse Malware via Hugging Face

Exploitation of Bomgar RMM Vulnerability Triggers LockBit Ransomware Surge

Critical RCE Vulnerability in Microsoft GitHub Repository Disclosed

RHEL 10 : hplip (RHSA-2026:82883) | Tenable®

CVE-2026-0322 PAN-OS: Authenticated Remote Code Execution (RCE) in the Management ...

Langflow 1.12.3 Fixes 25 CVEs, Two Unauth RCEs at 9.8

[Palo Alto Networks Security Advisories] CVE-2026-0322 PAN-OS: Authenticated Remote Code Execution (RCE) in theManagement Interface

4K3RCM7q9qslk2ZPIwf ZJs8Qev5

SAP Patches Critical NetWeaver, S/4HANA Vulnerabilities

France Supermarket Hacks Expose Risks Of Internet Facing Refrigeration Systems

Craft Cms 4.0.0 Before 4.18.7 And 5.0.0 Before 5.10.14 Rce Via Actioncacheupdates Behavior Injection

GitLab patches a max-severity regex flaw alongside five high

Hackers heat French supermarket fridges, sparking fires and spoiling food

Hackers Heat French Supermarket Fridges, Sparking Fires and Food Losses

WhatsApp Attachment Deploys Windows Malware With SYSTEM-Level Access

Old vulnerabilities in Apache Struts, BIND, and ProFTPD targeted by attackers

CVE-2026-108598 — Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates Most recent entries from cvelistv5 / 20h Affected: floci-io floci Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtime or ProcessBuilder, executing OS commands in the Fl

Code Injection Duo — 2 CVEs, Peak CVSS 9.8 in openapi-typescript-codegen and Floci Velocity ThreatAft — Cybersecurity Intelligence / 11h Impact: CVE-108551 allows JavaScript injection into generated TypeScript clients via unescaped Handlebars interpolation — supply-chain compromise of build pipelines. If your CI/CD pipeline ingests OpenAPI specs from vendors, partners, or public repos, an attacker controlling that spec achieves code execution inside your build environment.

CVE-2026-108598 - Exploits & Severity

Openapi Typescript Codegen Through 0.31.0 Code Injection Via Handlebars Templates

CVE-2026-108551: path keys Remote Code Execution (RCE) - Analysis & Fix

CISA Orders Federal Agencies to Patch Five Exploited Flaws by October 11 Amid Flax ...

github.com /advisories/GHSA-4gfv-wg42-7jw5

github.com /MervinPraison/PraisonAI/security/advisories/GHSA-4gfv-wg42-7jw5

CVE Alert: CVE-2021-3199 – n/a – n/a

BleepingComputer

Web applications

Cisco Talos reported

DB-GPT AI Agent Platform: Two Critical RCE CVEs at the Agent Data Access Layer

CVE Alert: CVE-2026-97673 – IBM

CVE Alert: CVE-2026-97655 – IBM

CVE Alert: CVE-2026-97676 – IBM

Multiple Vulnerabilities in Google Chrome Could Allow for Arbitrary Code Execution

Attackers Target AI Development Platform Langflow

LibreOffice and OpenOffice Flaws Let Malicious Spreadsheets Run Code Without Macro Warnings

The AI app builder your team trusts has a root

github.com /langflow-ai/langflow/issues/13336

github.com /advisories/GHSA-w584-2h2r-2hvf

github.com /advisories/GHSA-27vj-qcqg-25rc

gist.github.com /Ro1ME/c11b1e63e4e8fca6b25275144f25ec2a

CVE-2026-105740: Langflow Critical RCE: Authenticated Command Injection via Stdio Transport TheHackerWire / 3h Telemetry Metric Intelligence Detail CVE Identifier CVE-2026-105740 CVSS Severity 9.9 CRITICAL Affected Target 1.9.0 Vulnerability Class CWE-94: Remote Code Execution (RCE) Exploit Availability No Public PoC Indexed EPSS Threat Score Awaiting scoring CISA KEV Status Not Listed in CISA KEV Remediation Status Advisory / Mitigation In Review Any authenticated user can leverage an unvalidat

LibreOffice, OpenOffice Hit by Spreadsheet RCE via JDBC

Cvefeed High Severity Advisories Sep 19, 2025 CVE-2025-57644 - Accela Automation Platform Java RCE, SSRF, and File Write Vulnerability cvefeed.io Open source