exploit-CVE-2022-24780

iTop RCE via SSTI - CVE-2022-24780 exploit iTop --debug exploit.rb light --debug exploit.rb -h | --help full: exploit with an emulated browser, execute JavaScript, preserve original user profile information light: just parse HTML and send requests, no JavaScript, DESTRUCTIVE reset user informatio...

cve-2026-40176-cve-2026-40261

CVE-2026-40176 Composer Perforce Repository Remote Code Execution RCE 📋 Summary Command Injection vulnerability in Composer's Perforce repository driver allowing Remote Code Execution RCE through insufficient input validation in repository URL processing. 🎯 Vulnerability Details Property| Value...

PT-2026-120748

Name of the Vulnerable Software and Affected Versions YOOtheme Pro versions prior to 5.0.53 Description An issue exists that allows an unauthenticated attacker to achieve remote code execution through the image handler. Recommendations Update to version 5.0.53...

VulnCheck KEV: CVE-2024-39930

The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution. Authenticated attackers can exploit this by opening an SSH connection and sending a malicious --split-string env request if the built-in SSH server is activated...

VulnCheck KEV: CVE-2026-109618

PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may re...

VulnCheck KEV: CVE-2026-109619

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on...

Linux Distros Unpatched Vulnerability : CVE-2026-109618

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not properly account for this...

Linux Distros Unpatched Vulnerability : CVE-2026-113273

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML pag...

AlmaLinux 9.2 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792603232)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792603232 advisory. - PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not...

AlmaLinux 9.6 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792602059)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792602059 advisory. - PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not...

Rocky Linux 9.6 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792602059)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792602059 advisory. - PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may n...

PHP Vulnerability: CVE-2026-109618

PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may re...

PHP Vulnerability: CVE-2026-109619

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on...

PT-2026-120238

Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images. Attackers can submit malicious AVIF/HEIF input to applications processing untrusted images with sharp, triggering libheif...

PT-2026-120762

The quiet one in the Node.js batch is CVE-2026-106074. If you ship a single executable app or use a startup snapshot, the random caches behind crypto.randomUUID and randomInt got baked into the build, so every process hands out the same values. Upgrading Node on the server doesn't undo that...

Linux Distros Unpatched Vulnerability : CVE-2026-94300

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Replaying GSS-TSIG signed UDP messages can result in memory corruption in named. An attacker who can capture a previously signed UDP message can replay it while...

Atlassian Confluence 7.1.x < 9.2.26 / 9.3.x < 10.2.17 / 11.0.0 (CONFSERVER-104421)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104421 advisory. - jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8,...

PHP CGI SAPI 8.4.26 Pointer Underflow Remote Code Execution

PHP CGI SAPI versions 5.x through 8.4.26 reportedly contain a pointer underflow vulnerability in sapi/cgi/cgimain.c when cgi.fixpathinfo=1 is enabled. Manipulating PATHINFO with URL-encoded newline characters can trigger out-of-bounds pointer arithmetic, resulting in heap corruption and potential...

Linux Distros Unpatched Vulnerability : CVE-2026-113302

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML...

Linux Distros Unpatched Vulnerability : CVE-2026-113034

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTM...