YAHOO!

The OAuth Profile Is the Door: F5 BIG-IP APM’s Heap Overflow Turns a Network Security Appliance Into an Unauthenticated Entry Point

IP APM A heap-based buffer overflow (CWE-122) in the F5 BIG-IP Access Policy Manager (APM) allows for unauthenticated remote code execution directly on the Traffic Management Microkernel (TMM) data ...
The Hacker News

Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone

Unbound 1.26.1 fixes a critical DNSSEC heap overflow that malicious zones can trigger, with possible remote code execution.
Hosted on MSN

An 18-year-old heap buffer overflow in NGINX gives attackers remote code execution — billions of devices run the affected module

A single rewrite rule, the kind pasted into NGINX configurations thousands of times a day, can hand an unauthenticated attacker full remote code execution on the underlying server. The vulnerability, ...