Everything Threat Times has reported about remote code execution: 47 stories, newest first. Part of our Vulnerabilities coverage.
The National Vulnerability Database lists a CVSS 10 critical flaw in Wavlink WL-WN530BE1-A firmware version 251117, allowing remote attackers to exploit a buffer overflow via HTTP headers.
A security researcher found that Google’s developer documentation sites exposed an OAuth secret that allowed unauthenticated remote code execution via pickle deserialization.
IBM released patches for 22 vulnerabilities in Verify Access, addressing two critical remote code execution bugs that require no authentication.
A critical vulnerability in Perforce Helix Authentication Service allows attackers to exploit default credentials and chain flaws for remote code execution.
Simon Koeck discovered that unauthenticated attackers could forge session cookies to execute remote code on multiple Google developer sites.
AnyDesk released version 8.0.3 to address a heap buffer overflow in Linux builds that allowed attackers to gain root access before user approval.
A critical vulnerability in IBM i versions 7.3 through 7.6 enables authenticated attackers to execute arbitrary code via improper data sanitization.
A critical flaw in IBM Maximo AI Service 9.1.0 and 9.2.0 allows remote attackers to run arbitrary code via improper control of code generation.
A high-severity vulnerability in the Windows client allows attackers to run local binaries via manipulated IPC bridges and unvalidated connections.
A critical vulnerability in Edimax BR-6208AC firmware allows remote attackers to inject commands via a file upgrade form.
Netcore NR268 firmware 1.7.121109 contains a critical improper authentication flaw in CGI execution that allows remote attacks.
A critical vulnerability in AnyDesk versions prior to 8.0.3 enables unauthenticated remote attackers to execute arbitrary code as root on Linux systems without user approval.
GitLab released urgent updates on October 12 to fix a maximum-severity vulnerability allowing unauthenticated attackers to run arbitrary code on servers.
CERT-EU urges immediate upgrades for self-managed GitLab instances after a critical remote code execution flaw was disclosed.
Researchers disclosed a vulnerability chain in LG’s smart TV operating system that enables unauthorized remote command execution with root privileges.
GitLab issued urgent updates on October 8, 2026, to address multiple vulnerabilities, including a remote code execution flaw in CI/CD regular expressions.
Splunk released updates for Enterprise on October 7, 2026, fixing 22 vulnerabilities, including a CVSS 9.8 flaw allowing remote code execution.
A zero-click flaw in AnyDesk Linux 8.0.2 enables remote attackers to execute commands as root without user approval or authentication credentials.
The National Vulnerability Database has assigned a 9.4 score to CVE-2026-108540, a command injection vulnerability in OpenSpug Spug that allows remote attackers to execute arbitrary operating system commands.
Unauthenticated attackers can execute arbitrary code on WordPress sites using the vulnerable 3D Product Configurator plugin due to missing security checks.
A critical vulnerability in the Extensions For CF7 WordPress plugin enables unauthenticated attackers to execute remote code via arbitrary file upload.
A vulnerability in the Zammad customer support platform allows attackers to leak session data and execute remote code, according to a community analysis.
A critical vulnerability in Wizarr media server management software enables attackers to run arbitrary Python code and OS commands.
Researchers released code for an unauthenticated remote code execution bug in AnyDesk Linux that grants root access, though a patch is available.