Remote code execution vulnerabilities
Remote code execution lets an attacker run arbitrary code on the target system, usually over the network and in the worst cases without authentication. RCE is the most severe vulnerability class: a single unauthenticated RCE in an internet-facing product routinely leads to mass exploitation within days, and RCE entries dominate the CISA KEV catalog.
Classification is assigned by the CSIRTS enrichment pipeline from the advisory text. The list below shows the latest advisories tagged remote code execution, newest first, across national CERTs, vendor PSIRTs and vulnerability databases — exploited marks CVEs in the CISA KEV catalog.
Latest remote code execution advisories
USN-8680-1: FFmpeg vulnerabilities
Gitea security advisory (AV26-845)
[NEW] [medium] libTIFF: Multiple Vulnerabilities
Zoneminder
Siemens SIMATIC IoT2050 Advanced
CISA Adds One Known Exploited Vulnerability to Catalog
[NEW] [high] PostgreSQL: Multiple vulnerabilities
[NEW] [high] ZScaler Client Connector: Multiple Vulnerabilities
[NEW] [high] Red Hat Enterprise Linux (mrtg, kbd, urwid): Multiple vulnerabilities
[NEW] [medium] GStreamer: Multiple vulnerabilities
[NEW] [critical] vm2: Multiple Vulnerabilities
[UPDATE] [high] NGINX Open Source and NGINX Plus: Multiple vulnerabilities
[UPDATE] [high] NGINX and NGINX Plus: Multiple vulnerabilities
[NEW] [high] NGINX NGINX Plus: Multiple vulnerabilities
[NEW] [high] Langflow OSS: Multiple Vulnerabilities
[NEW] [medium] Autodesk 3ds Max: Multiple Vulnerabilities
[NEW] [high] SEPPmail Secure E-Mail Gateway: Multiple Vulnerabilities
[NEW] [medium] DrayTek Vigor Switches: Multiple Vulnerabilities Enable Code Execution
[NEW] [medium] DrayTek VigorAP: Multiple Vulnerabilities Enable Code Execution
[NEW] [UNPATCHED] [high] WebKitGTK: Vulnerability allows Code Execution
[NEW] [medium] IBM WebSphere Application Server: Vulnerability allows execution of actions
[NEW] [medium] GIMP: Multiple Vulnerabilities
[UPDATE] [high] IBM WebSphere Application Server and Application Server Liberty: Multiple vulnerabilities
[UPDATE] [high] Apache HTTP Server: Multiple vulnerabilities
[NEW] [medium] bluez: Vulnerability allows Execution of Arbitrary Code with Administrator Privileges
[NEW] [high] Snipe-IT: Multiple Vulnerabilities
[UPDATE] [medium] Linux Kernel: Multiple Vulnerabilities
[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities
[UPDATE] [high] Linux Kernel: Multiple Vulnerabilities
[UPDATE] [medium] LibreOffice: Vulnerability allows Code Execution
[UPDATE] [high] IBM WebSphere Application Server: Multiple vulnerabilities
[UPDATE] [high] IBM WebSphere Application Server: Multiple vulnerabilities
[NEW] [high] Google Chrome: Multiple vulnerabilities
[NEW] [high] Apple macOS, iOS and iPadOS: Multiple vulnerabilities
[NEW] [critical] GeoServer: Vulnerability allows SQL injection and potentially code execution
[NEW] [medium] Red Hat Enterprise Linux (yelp, dracut): Multiple vulnerabilities
[NEW] [high] Red Hat Enterprise Linux (nodejs:24): Multiple vulnerabilities
[NEW] [high] Linux Kernel: Multiple vulnerabilities
[NEW] [high] Django: Multiple Vulnerabilities
[NEW] [high] IBM WebSphere Application Server and Application Server Liberty: Multiple vulnerabilities
[NEW] [high] ffmpeg: Multiple vulnerabilities
[NEW] [high] Erlang/OTP: Multiple vulnerabilities
[NEW] [high] libssh2: Multiple vulnerabilities
[NEW] [high] Red Hat Ansible Automation Platform (node-tar, linkify-it, protobufjs, brace-expansion, fast-uri, DOMPurify): Multiple vulnerabilities
[NEW] [high] Foxit PDF Editor and PDF Reader: Multiple vulnerabilities
[UPDATE] [high] libssh2: Multiple vulnerabilities
[UPDATE] [medium] vllm: Vulnerability allows code execution
[UPDATE] [high] Microsoft Windows: Multiple vulnerabilities
[UPDATE] [high] Unbound: Multiple vulnerabilities
Other vulnerability classes
New remote code execution advisories, in your inbox. The daily briefing covers every advisory in this class the morning after it lands. Subscribe free — one email every morning after 06:00 UTC, one-click unsubscribe. Tracking specific products instead? Watch them from any product page and get alerted only when they ship a new advisory.