Latest RCE news

A single false parameter passed to .NET's Response.Redirect() kept the admin panel rendering after a redirect. watchTowr chained it to RCE on 30,000 internet-facing ShareFile servers. Patched March 10, disclosed April 2.

The quietest day of the month still delivered a pattern worth tracking. MLflow picked up its fourth authentication or input validation flaw in six weeks. pymetasploit3 got a CVSS 9.3 command injection in its core module execution function.

165 new CVEs on April 2 include a pre-auth RCE chain in Progress ShareFile with 30,000 exposed instances and a CVSS 10.0 SSRF in FastMCP. TP-Link Tapo camera, Convoy KVM, and WordPress plugin flaws round out the batch.

88 new CVEs on March 31 include a CVSS 10.0 NocoBase sandbox escape to root RCE, a WordPress Everest Forms Pro RCE, five baserCMS command injections, and SQL injections in Umami and SciTokens. Eleven vulnerabilities scored 9.0 or above.

A CVSS 10.0 sandbox escape in NocoBase's Workflow JavaScript node lets authenticated users reach root RCE through three lines of code. The console object leaks a host-realm Function constructor via prototype chain traversal. Patched in v2.0.28.

A denial-of-service bug patched five months ago turned out to be unauthenticated RCE with CVSS 9.8. F5 confirmed nation-state exploitation of CVE-2025-53521 in BIG-IP APM, and CISA gave federal agencies three days to patch. 240,000+ instances are exposed.

Three miIO protocol flaws chain into root RCE on the Xiaomi C400 camera. TASZK Security Labs published the full exploit and a cloud jailbreak tool. A Wi-Fi-adjacent attacker needs no QR code and no physical access to the device.

Five critical vulnerabilities lead the March 14-15 batch of 215 new CVEs. A CVSS 9.8 unauthenticated WordPress RCE, OneUptime's fourth CVSS 9.9 in six weeks, and three unpatched D-Link buffer overflows top the list.

An unauthenticated file upload in the WordPress Pix for WooCommerce plugin scored CVSS 9.8, and OneUptime collected its fourth critical vulnerability in two weeks. The March 14 digest covers 10 high-severity flaws including two Chrome zero-days.