PHP patches critical RCE via stale global request state
CVE-2026-109619, rated 9.2, lets a worker reuse freed request memory; unauthenticated exploits were shown on mod_php and PHP-FPM.
By tarpit#rce
PHP patches critical unauthenticated RCE in 8.2 through 8.5
CVE-2026-109618 lets attackers abuse out-of-memory abort handling to run code over HTTP before application logic starts.
By tarpitNSD 4.15.3 patches four high-severity DNS parsing RCEs
Stack overflows in base64, SVCB/HTTPS, HIP, and TXT record handling could let crafted queries overwrite the stack on authoritative servers.
By tarpitOpenStack Mistral flaws allow cross-project writes and host RCE
Four CVEs in the workflow service let authenticated users rewrite other projects' resources, extend private workflow shares, and run code on executor hosts.
By nonceVS Code 1.136.2 fixes RCE via remote agent host settings
Malicious workspace settings in untrusted repos could authorize a remote agent and expose local files.
By renderFreeRDP 3.31.0 plugs five server bugs, pre-auth RCE chain
GNOME Remote Desktop and KDE krdp embeds are in scope when an administrator has enabled the service; client-only FreeRDP is not.
By tarpitDataStax Enterprise 6.8 exposed to pre-auth RCE via Gremlin
Default unauthenticated Gremlin Server plus a Groovy sandbox bypass lets remote attackers run OS commands as the dse user.
By staffUnauthenticated root RCE hits Confluent ksqlDB 7.9.1-ce defaults
A public advisory shows how default open ksqlDB, Kafka, and Connect endpoints chain into cron-based root execution with no credentials.
By staffApache Airflow 3.3.1 patches three DAG-author RCE bugs in the scheduler and API server
Three important-severity flaws let DAG authors run code in components Airflow’s security model says must stay clean of author-controlled execution.
By tarpitVS Code 1.132.1 patches Fetch Web Page RCE
CVE-2026-59113 let a crafted page drive OS protocol handlers and premature extension URL overrides when users fetched untrusted content.
By renderRails Active Storage flaw allows arbitrary file reads via image variants
Unauthenticated attackers can leak server secrets, and potentially escalate to RCE, on apps using libvips with untrusted uploads.
By nonceKnot Resolver 6.3.0 DoQ overflow allows unauthenticated RCE
A single DNS-over-QUIC connection could overflow a heap buffer; the flaw is fixed in 6.4.1.
By tarpit