PT-2026-127301

Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

Redis < 7.2.14 / 7.4.x < 7.4.9 / 8.2.x < 8.2.6 / 8.4.x < 8.4.3 / 8.6.x < 8.6.3 / 8.8.x < 8.8-RC1 Multiple Vulnerabilities

The version of Redis installed on the remote host is prior to 7.2.14, or 7.4.x prior to 7.4.9, or 8.2.x prior to 8.2.6, or 8.4.x prior to 8.4.3, or 8.6.x prior to 8.6.3, or 8.8.x prior to 8.8-RC1. It is, therefore, affected by multiple vulnerabilities: - A use-after-free vulnerability exists in...

Security Update for Microsoft .NET Core (October OOB 2026)

The Microsoft .NET Core installations on the remote host are missing a security update. It is, therefore, affected by multiple vulnerabilities as referenced in the vendor advisory. - Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network. CVE-2026-70197 -...

Security Update for Microsoft .NET Core SDK (October OOB 2026)

The Microsoft .NET Core SDK installations on the remote host are missing a security update. It is, therefore, affected by multiple vulnerabilities as referenced in the vendor advisory. - Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network. CVE-2026-70197 -...

PHP Session Serialization Desynchronization Remote Code Execution

PHP web applications that dynamically switch session serialization handlers between phpserialize and php may be susceptible to session desynchronization and injection attacks. An unauthenticated attacker can abuse the PHPSESSIONUPLOADPROGRESS mechanism to inject specially crafted session data tha...

Google Chrome Vulnerability: CVE-2026-118305

Memory corruption in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

Planet Technology Planet WGS-804HPT Improper Neutralization of Special Elements Used in an OS Command (CVE-2024-52320)

PLANET WGS-804HPT is vulnerable to a command injection. An unauthenticated attacker could send commands through a malicious HTTP request which could result in remote code execution. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...

KLA91378 Multiple vulnerabilities in Mozilla Firefox ESR

Multiple vulnerabilities were found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information. Below is a complete list of vulnerabilities: 1. A remote code execution...

CVE-2026-78845

Several Aidot products are vulnerable to Remote Code Execution (RCE) due to an issue in UPnP root description parsing . The affected devices include the Linkind Matter Smart Plug (version 1.01.32), OREiN Matter Smart Light Bulb (version 3.15.21), and the Linkind Wi-Fi Smart Light Bulb (version 3....

SPIP 4.4.19 and Earlier Remote Code Execution

SPIP versions before 4.4.20 contain an unauthenticated remote code execution vulnerability related to PHP block identification and varexport handling. The included proof of concept detects affected targets and deploys command execution and file-upload PHP shells...

PT-2026-127257

Memory corruption in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

PHP 8.5.11 Remote Code Execution

PHP version 8.5.11 contains an out-of-memory handling flaw that can result in remote code execution. The included proof of concept targets Apache modphp prefork deployments using multipart requests and session-state disclosure. https://packetstorm.news/download/237867...

Vulnerabilities Resolved in Veeam Backup for Microsoft 365 8.6

Veeam Software Security Commitment Veeam® is committed to ensuring its products protect customers from potential risks. As part of that commitment, we operate a Vulnerability Disclosure Program VDP for all Veeam products and perform extensive internal code audits. When a vulnerability is...

WordPress 7.0.1 REST API Batch Route Confusion Remote Code Execution

WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 contain a REST API batch-route confusion issue which, when combined with SQL injection, can lead to remote code execution. https://packetstorm.news/download/237893...

SPIP 4.4.19 Remote Code Execution

SPIP versions before 4.4.20 contain an unauthenticated remote code execution vulnerability. The supplied proof of concept delivers PHP code through the search parameter and attempts to write command and upload shells to successful targets. https://packetstorm.news/download/237890...

Kestra 1.3.20 Authentication Bypass / Remote Code Execution

Kestra version 1.3.20 contains an authentication-filter bypass that permits unauthenticated workflow creation and execution through a path ending in /configs, resulting in command execution inside the worker container. https://packetstorm.news/download/237872...

Microsoft Windows SMBv1 Remote Code Execution

This document provides a proof of concept workflow for identifying vulnerable Microsoft Windows SMBv1 hosts and exploiting the MS17-010 EternalBlue vulnerability with Metasploit. https://packetstorm.news/download/237889...

GitLab 19.4.1 CI/CD Regular Expression Remote Code Execution

GitLab versions 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 contain an integer overflow in CI/CD regular expression handling that can allow remote code execution. Includes a proof of concept. https://packetstorm.news/download/237901...

Juniper Junos OS Evolved 25.4 PTX Series Unauthenticated Remote Code Execution

Juniper Junos OS Evolved on PTX Series versions before 25.4R1-S1-EVO and 25.4R2-EVO contain an unauthenticated remote code execution vulnerability. The supplied proof of concept creates and executes a command through the affected configuration API. https://packetstorm.news/download/237898...

Langflow 1.12.4 Authenticated Remote Code Execution

Langflow versions 1.0.0 through 1.12.4 contain a missing authorization issue in the authenticated A2A JSON-RPC execution path that allows an authenticated user to execute arbitrary code by bypassing execution gates. https://packetstorm.news/download/237876...