Topic

RCE: news, advisories and analysis

15 articlesUpdated 12 Oct 2026

CyberSecureToday covers RCE across 15 articles published between 14 Sep 2026 and 12 Oct 2026. The coverage includes 14 vulnerability advisories. 14 advisories are rated critical or high severity, and 2 involve flaws listed in CISA's Known Exploited Vulnerabilities catalog.

Stories on RCE most often intersect with Remote Code Execution, Microsoft and Cloud Security, with Technology, Cloud & SaaS the most affected sector. The most recent story, “ChromaDB Vector Database Vulnerability Enables Unauthenticated Metadata Filter SQL Injection and Host Takeover (CVE-2026-78110)”, was published 12 Oct 2026. Every article is listed below, newest first, with the affected products, severity and remediation guidance in each piece.

Latest coverage

NewsCloud & SaaSCritical
ChromaDB Vector Database Vulnerability Enables Unauthenticated Metadata Filter SQL Injection and Host Takeover (CVE-2026-78110)
ChromaDB patches a critical vulnerability (CVE-2026-78110) in vector metadata filtering that allows unauthenticated remote attackers to execute arbitrary code.
CST Editorial Desk12 Oct 20268 min read
NewsIndustrial & OTCritical
Siemens SIMATIC Energy Manager PRO Flaw Enables Unauthenticated Remote Code Execution
Siemens issues emergency updates for SIMATIC Energy Manager PRO (CVE-2026-76880, CVSS 9.8) resolving an unauthenticated OPC UA deserialization vulnerability.
CST Editorial Desk12 Oct 20268 min read
ThreatsCloud & SaaSCritical
OpenAI Whisper and Triton Flaw Enables Code Execution via Malformed Audio Headers
PyTorch Foundation and OpenAI issue security advisories for speech inference pipelines addressing a critical deserialization flaw enabling arbitrary command execution.
Aisha Noor9 Oct 20268 min read
ThreatsIndustrial & OTCritical
Yokogawa FAST/TOOLS SCADA Gateway Buffer Overflow Vulnerability Enables Remote Industrial Process Disruption (CVE-2026-56891)
Yokogawa Electric issues a critical security bulletin detailing a heap-based buffer overflow in FAST/TOOLS SCADA servers permitting remote code execution.
CST Editorial Desk9 Oct 20268 min read
ThreatsCloud & SaaSHigh
Microsoft Outlook Memory Parsing Flaw Enables Remote Code Execution via Crafted Documents
Microsoft MSRC discloses high-severity 8.8 CVSS RCE flaw CVE-2026-70125 in Microsoft Outlook enabling arbitrary code execution via crafted compound documents.
CST Editorial Desk26 Sep 202614 min read
ThreatsCloud & SaaSHigh
AWS pgcollection Type Confusion Flaw Enables Remote Code Execution in PostgreSQL
AWS Security Bulletin 2026-118-AWS warns of a critical type confusion flaw CVE-2026-96883 in open-source pgcollection enabling RCE in PostgreSQL database hosts.
CST Editorial Desk26 Sep 202614 min read
ThreatsCloud & SaaSCritical
WordPress Core Template Traversal Flaw Weaponized for Remote Code Execution
WordPress releases emergency update 7.1.2 to patch critical path traversal flaw CVE-2026-87902 in get_page_template() weaponized in active web attacks.
Mei-Lin Chen26 Sep 202614 min read
ThreatsCloud & SaaSCritical
Microsoft SharePoint SafeControls Bypass Weaponized for Remote Code Execution
Microsoft reclassifies CVE-2026-65660 as an 8.8 CVSS RCE flaw after threat actors bypass SharePoint SafeControls filtering to execute arbitrary .NET code.
CST Editorial Desk26 Sep 202614 min read
ThreatsCloud & SaaSCritical
Oracle WebLogic Server Flaw Allows Unauthenticated Remote Code Execution Across Java Clusters
Oracle's Critical Security Patch Update fixes maximum-severity CVSS 10.0 flaw CVE-2026-83021 in WebLogic Server Core enabling unauthenticated remote takeover.
Priya Raman22 Sep 202617 min read
ThreatsCloud & SaaSHigh
Microsoft Azure CLI Command Injection Vulnerability CVE-2026-83948 Exposes Cloud CI/CD Automation Runners
Microsoft patches important command injection flaw CVE-2026-83948 in Azure CLI, requiring customer updates to prevent remote code execution in CI/CD pipelines.
Aisha Noor22 Sep 202614 min read
ThreatsCloud & SaaSCritical
Langflow Custom Component Code Validator Flaw CVE-2026-0768 Weaponized for Remote Code Execution Across AI Pipelines
Critical code validation bypass flaw CVE-2026-0768 in Langflow AI orchestration platform allows unauthenticated remote attackers to execute arbitrary system commands.
Mei-Lin Chen21 Sep 202616 min read
ThreatsIndustrial & OTCritical
Digital Watchdog VMAX Recorder Flaws Enable Unauthenticated Remote Root Takeover
CISA releases advisory ICSA-26-258-01 warning of critical vulnerabilities in Digital Watchdog VMAX DVR and NVR recorders allowing unauthenticated remote root code execution.
Mei-Lin Chen20 Sep 202612 min read
ThreatsCloud & SaaSCritical
Microsoft Entra ID Critical Deserialization Vulnerability Enables Unauthenticated Remote Code Execution
Microsoft resolves maximum-severity CVSS 10.0 vulnerability CVE-2026-69836 in Entra ID allowing unauthenticated remote code execution via unsafe object deserialization.
Daniel Okafor19 Sep 202612 min read
ThreatsHealthcare & PharmaCritical
NextGen Mirth Connect Critical RCE Flaws Expose Healthcare HL7 Data Pipelines
CISA published an urgent medical ICS advisory detailing critical RCE vulnerabilities in NextGen Mirth Connect integration engines routing hospital clinical records.
Priya Raman14 Sep 20268 min read
NewsCloud & SaaS
Google September 2026 Android Bulletin Patches Critical System Zero-Click RCE Flaws
Google’s September 2026 Android security update resolves 34 vulnerabilities, led by critical zero-click remote code execution defects in the Android System framework.
Mei-Lin Chen14 Sep 20267 min read