CVE-2026-106763

An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions...

PHP 8.5.11 Remote Code Execution Hardening Tool

PHP versions 5.4.0 through 8.5.11 contain two remote code execution vulnerabilities. This tool audits PHP runtime configuration and provides hardening templates for interim mitigation...

PT-2026-122137

An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions...

EUVD-2026-109094

An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function...

PT-2026-122139

An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function...

PT-2026-122127

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, ExternalFilesDownloader.getFilename extracts the destination filename from a server-supplied Content-Disposition response header and passes it directl...

EUVD-2026-109096

An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions...

SUSE SLED15: WebKitGTK-4.0-lang / WebKitGTK-4.1-lang / WebKitGTK-6.0-lang / etc (SUSE-SU-2026:4858-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4858-1 advisory. Security issues fixed: WebKitGTK and WPE WebKit Security Advisory WSA-2026-0006 bsc1284619: - CVE-2024-1283:...

JetBrains TeamCity 2026.1.2 Agent Polling Remote Code Execution

JetBrains TeamCity versions before 2026.1.3 and 2025.11.7 contain an unauthenticated agent-polling protocol deserialization vulnerability that allows remote code execution. https://packetstorm.news/download/237301...

PYSEC-2026-4322 Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package

CVE-2026-111497 "Node2Shell" is an out-of-bounds write CWE-787 in Google's Brotli decoder c/dec/decode.c. DecodeBlockTypeAndLength returns an ambiguous value for an invalid block switch, and the fast decode path discards it CWE-252, unchecked return value, so a crafted Brotli stream makes the...

PYSEC-2026-4323 Out-of-bounds write in the brotlicffi decoder ("Node2Shell") also affects the PyPI Brotli package

CVE-2026-111497 "Node2Shell" is an out-of-bounds write CWE-787 in Google's Brotli decoder c/dec/decode.c. DecodeBlockTypeAndLength returns an ambiguous value for an invalid block switch, and the fast decode path discards it CWE-252, unchecked return value, so a crafted Brotli stream makes the...

Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package

CVE-2026-111497 "Node2Shell" is an out-of-bounds write CWE-787 in Google'sBrotli decoder c/dec/decode.c. DecodeBlockTypeAndLength returns an ambiguousvalue for an invalid block switch, and the fast decode path discards itCWE-252, unchecked return value, so a crafted Brotli stream makes the...

Out-of-bounds write in the brotlicffi decoder ("Node2Shell") also affects the PyPI Brotli package

CVE-2026-111497 "Node2Shell" is an out-of-bounds write CWE-787 in Google'sBrotli decoder c/dec/decode.c. DecodeBlockTypeAndLength returns an ambiguousvalue for an invalid block switch, and the fast decode path discards itCWE-252, unchecked return value, so a crafted Brotli stream makes the...

Vaadin and the October 2026 Node.js security releases

A deployed Vaadin application does not run Node.js, so it is not exposed to the vulnerabilities fixed in the Node.js security releases of 21 October 2026. Vaadin uses Node.js only to build the frontend and to run development mode, which means the exposure, where there is any, is in build and...

Brotli Node.js Code Execution

The vulnerability of the Brotli data compression algorithm in the Node.js software platform lies in the lack of checking for the return value. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Alibaba Cloud Linux 3 : 0318: php (ALINUX3-SA-2026:0318)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0318 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2025-1218: The mysqlnd wire protocol...

Amazon Linux Unpatched Vulnerability : CVE-2026-109619

The remote Amazon Linux host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be...

Apache ActiveMQ 5.18.2 OpenWire Remote Code Execution

Apache ActiveMQ versions before 5.15.16, 5.16.7, 5.17.6, and 5.18.3 contain an OpenWire deserialization flaw that allows unauthenticated remote code execution. This proof of concept sends a crafted ExceptionResponse frame. https://packetstorm.news/download/237303...

Security Advisory 0200

Security Advisory 0200 PDF Date: October 23, 2026 Revision | Date | Changes ---|---|--- 1.0 | October 23, 2026 | Initial release Description Arista Networks is providing this security advisory in response to the following PHP vulnerabilities. These vulnerabilities were discovered by external...

CVE-2026-115560

A flaw in PHP's session upload progress handling can lead to remote code execution when an application sets session.serializehandler to phpbinary or phpserialize in its configuration and switches it to php at runtime with iniset before calling sessionstart, while session.uploadprogress.enabled is...