Rce news

Critical vulnerabilities have been found in the SEPPMail Secure E-Mail Gateway, an enterprise email security solution. Attackers could exploit these flaws to execute code remotely, read all email traffic passing through the appliance, and potentially gain access to the company's internal network, posing a significant security risk.

A vulnerability has been found in GStreamer Good Plugins due to improper handling of specific MOV/MP4 media files. A remote attacker could exploit this flaw to crash the application, leading to a denial of service, or potentially gain the ability to execute arbitrary code on the affected system.

Drupal has issued security updates for a highly critical vulnerability in its Core software, tracked as CVE-2026-9082. The flaw affects sites using a PostgreSQL database and could allow attackers to execute remote code, escalate privileges, or access sensitive information. Immediate patching is strongly recommended.

The SGLang AI framework has three critical vulnerabilities, including two for remote code execution. An attacker with network access can exploit them if the multimodal mode is enabled. The project maintainers have not responded, and no patch is currently available for these significant security flaws.

A critical security flaw in NGINX Plus and NGINX Open is being actively exploited in the wild, just days after it was disclosed. The vulnerability, CVE-2026-42945, is a heap buffer overflow affecting a wide range of NGINX versions from 0.6.27 through 1.30.0.

A recently published guide demonstrates how a vulnerability in SAR2HTML version 3.2.1 can be exploited for remote code execution. The walkthrough, based on a TryHackMe challenge, shows how attackers can gain root privileges and full control over a target system by leveraging this specific software flaw.