Do Son SonicWall patched a critical flaw (CVE-2025-40604) in its Email Security appliances. The bug allows persistent RCE by exploiting a lack of integrity checks when loading the root filesystem image from the VM datastore.
rce
Threat actors are actively exploiting a new WSUS RCE flaw (CVE-2025-59287) to gain SYSTEM shells and deploy the dangerous ShadowPad backdoor. Patch immediately!
Apache patched a Critical RCE flaw (CVE-2025-64408) in Causeway allowing authenticated attackers to execute arbitrary code via Java deserialization in the ViewModel component. Update to v3.5.0.
CISA added a FortiWeb RCE flaw (CVE-2025-58034) to its KEV Catalog due to active exploitation. The bug allows authenticated attackers to execute arbitrary code on the WAF via crafted requests. Update now.
D-Link warned that DIR-878 has reached EOL with three unpatched RCE flaws. Unauthenticated remote attackers can execute arbitrary commands via Dynamic DNS and DMZ settings due to insecure CGI parameters.
METZ CONNECT patched five critical flaws in EWIO-2 industrial controllers. CVE-2025-41734 allows unauthenticated PHP RCE, and CVE-2025-41733 risks admin credential reset. Update to v2.2.0 immediately.
SolarWinds patched three Critical RCE flaws (CVSS 9.1) in Serv-U. An authenticated admin can exploit them for code execution and directory path bypass. Update to v15.5.3 immediately.
pgAdmin patched four flaws. The Critical RCE (CVE-2025-12762) risks arbitrary code execution via malicious PostgreSQL dump files. LDAP Injection (CVE-2025-12764) and TLS Bypass were also fixed. Update to v9.10.
IBM patched four critical flaws in AIX/VIOS. The RCE (CVSS 10.0) in nimesis and CVE-2025-36096 allow remote attackers to execute commands and obtain NIM private keys. Update immediately.
Amazon uncovered an advanced APT simultaneously exploiting Cisco ISE RCE (CVE-2025-20337) and Citrix Bleed Two (CVE-2025-5777) as zero-days. The attacker deployed a custom in-memory web shell on Cisco ISE.
A Critical flaw (CVE-2025-11919) in Wolfram Cloud allows RCE and privilege escalation. Attackers exploit a race condition in the shared /tmp/ directory to inject code into other tenants' JVMs.
A XSS flaw in Open WebUI allows authenticated users to achieve Admin RCE by injecting JavaScript into rich text prompts, then exploiting the Functions feature. Update to v0.6.35.
A Critical flaw in Lite XL (CVE-2025-12120) allows RCE when opening a project: the editor automatically executes malicious .lite_project.lua files, risking developer compromise.
Apache patched a Critical RCE flaw (CVE-2025-59118) in OFBiz ERP that allows remote attackers to upload arbitrary files with dangerous types. A reflected XSS flaw was also fixed.
Microsoft's November Patch Tuesday fixes 68 vulnerabilities, including CVE-2025-62215, an actively exploited Windows Kernel zero-day allowing local attackers to gain SYSTEM privileges via a race condition.
SAP released its Patch Day update fixing 18 flaws, including two Critical (CVSS 10.0) vulnerabilities: RMI-P4 RCE and Hard-Coded Credentials in SQL Anywhere Monitor, risking unauthenticated takeover.
Critical Synology BeeStation Zero-Day (CVE-2025-12686) Found at Pwn2Own Allows Remote Code Execution
Critical Synology BeeStation Zero-Day (CVE-2025-12686) Found at Pwn2Own Allows Remote Code Execution
Synology patched a Critical (CVSS 9.8) RCE zero-day flaw (CVE-2025-12686) in BeeStation OS. The vulnerability, found during Pwn2Own, allows remote attackers to execute arbitrary code. Update to v1.3.2-65648.
A Critical (CVSS 9.3) RCE flaw (CVE-2025-64486) in Calibre allows arbitrary code execution when a user views or converts a malicious FB2 e-book due to unsafe filename handling. Update to v8.14.0.
A RCE flaw (CVE-2025-64439) in LangGraph's JsonPlusSerializer allows arbitrary Python code execution by exploiting a fallback during checkpoint deserialization. Update to v3.0.
Cisco patched two Critical flaws in Unified CCX. CVE-2025-20354 (CVSS 9.8) risks unauthenticated root RCE via Java RMI, and CVE-2025-20358 allows admin bypass via the CCX Editor application.
CISA added two critical, actively exploited flaws to its KEV Catalog: Gladinet LFI (CVE-2025-11371) risks RCE via machine key theft, and CWP RCE (CVE-2025-48703) allows unauthenticated admin takeover.
A Critical RCE flaw (CVE-2025-11953, CVSS 9.8) in React Native Community CLI allows unauthenticated attackers to execute arbitrary code via a command injection in the exposed Metro Dev Server.