CVE-2026-114549

NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web...

CVE-2026-114549

A heap-based buffer overflow exists in the NoMachine nxwebrunner web service, which listens on TCP port 4443 by default. The vulnerability is caused by a lack of proper validation of the length of user-supplied data before it is copied to a heap-based buffer. Remote attackers can exploit this fla...

PT-2026-121737

Name of the Vulnerable Software and Affected Versions NoMachine nxwebrunner affected versions not specified Description A heap-based buffer overflow exists in the web service that listens on TCP port 4443 by default. The issue occurs because the service fails to properly validate the length of...

PT-2026-91880

First CVE IDs are in — MITRE assigned 10 CVEs to our research CVE-2026-88557 → 88566. All 10 were found, verified end-to-end, and disclosed first by our AI-driven research pipeline. Every single one ships a full root-cause analysis and a working, reproducible PoC — public since day one, no...