rce

CVE-2026-45185, found by XBOW's Federico Kirschbaum and patched in Exim 4.99.3, lets an unauthenticated SMTP client corrupt the heap via a TLS close_notify during a CHUNKING transfer.

An unauthenticated WebSocket flaw in the popular Marimo notebook (CVE-2026-39987, CVSS 9.3) was weaponized within 9 hours 41 minutes of disclosure, with credential theft completed in under three minutes. CISA has since added the bug to its KEV catalog with a May 7 federal deadline.

A CVSS 9.9 command-injection bug in BeyondTrust Remote Support and Privileged Remote Access lets unauthenticated attackers execute OS commands, echoing the zero-days that gave Chinese state hackers access to the U.S. Treasury in 2024.