Do Son A Critical (CVSS 9.8) LFI flaw (CVE-2025-12493) in ShopLentor (WooCommerce Builder) allows unauthenticated attackers to run arbitrary .php files and compromise 100K+ e-commerce sites.
rce
Redis patched a High-severity RCE flaw (CVE-2025-62507) in XACKDEL, allowing remote code execution via a stack buffer overflow on a stream ID list. The bug was discovered by Google Big Sleep.
ASEC confirmed Kinsing is exploiting Apache ActiveMQ RCE (CVE-2023-46604) to deploy XMRig cryptominer. The group now integrates Sharpire, Cobalt Strike, and Meterpreter for advanced post-exploitation.
A Critical Heap Overflow in strongSwan's EAP-MSCHAPv2 plugin allows Remote Code Execution on the client. An integer underflow in Failure Request packet processing causes memory corruption.
CISA added two critical DELMIA Apriso flaws (CVE-2025-6204/6205) to its KEV Catalog due to active exploitation. The flaws risk RCE and privileged access to manufacturing management systems.
Kaspersky found a Chrome zero-day (CVE-2025-2783) and sandbox bypass being exploited by Operation ForumTroll to deploy Memento Labs (Hacking Team) commercial Dante spyware against Russian targets.
A High-severity OpenVPN flaw (CVE-2025-10680) in beta versions allows script injection on Unix-like clients (Linux, macOS). Malicious DNS/DHCP arguments can execute arbitrary commands on the client side.
Apache patched three flaws in Tomcat 9/10/11: CVE-2025-55752 risks RCE by bypassing security constraints. CVE-2025-55754 allows ANSI escape sequence injection in Windows logs.
OpenWrt released v24.10.4 to fix two high-severity flaws: CVE-2025-62526 allows RCE via a heap buffer overflow in ubusd, and CVE-2025-62525 leaks kernel memory via a DSL driver.
CISA warned of 9 flaws in AutomationDirect PLCs. The Critical RCE (CVE-2025-61934, CVSS 10.0) allows unauthenticated file manipulation on a simulator service. Patch to v4.5.0.x immediately.
Microsoft released an emergency update for a critical WSUS flaw (CVSS 9.8) that allows unauthenticated RCE and is already being actively exploited.
Wordfence warned of a massive RCE campaign (8.7M+ attacks) exploiting flaws in GutenKit/Hunk Companion plugins. Unauthenticated attackers can install malicious plugins via vulnerable REST API endpoints.
A Critical RCE flaw (CVE-2025-59287, CVSS 9.8) in WSUS allows unauthenticated attackers SYSTEM access via AuthorizationCookie deserialization. The issue was patched in the October update.
SUSE patched a Critical RCE flaw (CVE-2025-54469, CVSS 10.0) in NeuVector Enforcer that allows attackers to inject commands via unsanitized environment variables, risking container root shell access.
A Critical RCE flaw (CVE-2025-61932, CVSS 9.8) in Lanscope Endpoint Manager (v9.4.7.1 and earlier) is actively exploited via malicious packets.
Google Project Zero disclosed a zero-click RCE flaw (CVE-2025-54957, CVSS 7.0) in Dolby's Audio Decoder. The integer overflow can be triggered by a single audio file and affects Android, iOS, and macOS.
A Critical (CVSS 9.8) RCE flaw in Keras 3’s Torch backend (CVE-2025-49655) allows attackers to execute arbitrary code by loading a malicious model due to insecure deserialization.
CISA added a Critical (CVSS 10.0) RCE flaw (CVE-2025-54253) in Adobe Experience Manager Forms to its KEV Catalog due to active exploitation. Patch is mandatory by Nov 5.
Samba released an urgent fix for a Critical (CVSS 10.0) RCE flaw (CVE-2025-10230) allowing unauthenticated command injection on AD DCs when the WINS hook is enabled. Update to 4.23.2.
Apache issued a critical fix for ActiveMQ NMS AMQP Client (CVE-2025-54539). The deserialization flaw allows untrusted AMQP servers to execute remote code on client systems.
Veeam patched two Critical RCE flaws (CVE-2025-48983 & -48984) in Backup & Replication v12 that let authenticated domain users compromise backup infrastructure.
Google released an urgent update for Chrome (v141.0.7390.107), patching a High-severity Use-After-Free flaw (CVE-2025-11756) in the Safe Browsing component. Update immediately.