VulnCheck KEV: CVE-2022-1471

SnakeYaml's Constructor class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. ...

Node.js 26.12.0 Brotli Decoder Remote Verifier

Node.js versions before 22.23.4, 24.22.1, and 26.12.1 contain an out-of-bounds write in the bundled Brotli decoder. This tool non-destructively verifies exposed HTTP request-body Brotli decoding paths using crafted compressed streams...

D-Link DCS-6501LH Wi-Fi camera Heap Buffer Overflow DoS

The vulnerability in the mydlinksetrootpwd function of the D-Link DCS-6501LH Wi-Fi camera is related to the use of weak credentials. Exploitation of this vulnerability may allow a remote attacker to execute arbitrary code...

Tenda BE3L Pro Form Wifi Basic Set Code Execution

The vulnerability in the formWifiBasicSet function of the Tenda BE3L Pro router software involves buffer overflow when processing the security5g parameter. Exploitation of this vulnerability could allow a remote attacker to execute arbitrary code...

PT-2026-125505

Pixar Animation Studio OpenUSD Crate File Parsing Double Free Remote Code Execution Vulnerability...

PHP 8.5.11 Session Upload Progress Remote Code Execution

PHP versions through 8.5.11 contain memory-corruption flaws that can allow unauthenticated remote code execution. This proof of concept uses crafted multipart upload-progress requests to trigger the vulnerability chain. https://packetstorm.news/download/237643...

PHP 8.5.11 Session Upload Progress Remote Code Execution

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain an OOM-driven session upload progress use-after-free that can lead to unauthenticated remote code execution. Includes a Python proof of concept for Apache modphp. https://packetstorm.news/download/237652...

PHP 8.5.11 Session Upload Progress Remote Code Execution

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain request-handling memory-corruption flaws. This proof of concept uses multipart upload progress handling to demonstrate remote code execution. https://packetstorm.news/download/237644...

MiracleLinux 9 : dotnet9.0-9.0.122-1.el9_8.ML.1 (AXSA:2026-2151:20)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2151:20 advisory. dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability CVE-2026-58280 dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET...

AlmaLinux 9.2 [TuxCare] Security Update: webkit2gtk3 / webkit2gtk3-devel / webkit2gtk3-jsc / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1793034547)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793034547 advisory. - Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to potentially execute...

Rocky Linux 9.6 [TuxCare] Security Update: hplip / hplip-common / hplip-libs / libsane-hpaio (ALMALINUX9.6:CLSA-2026:1793015517)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793015517 advisory. - HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software componen...

PT-2026-123400

Name of the Vulnerable Software and Affected Versions OpenHands Software Agent SDK versions prior to 1.52.0 Description An unauthenticated remote code execution issue exists where the DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces 0.0.0.0...

PT-2026-125501

libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability...

PHP 8.5.11 Remote Code Execution Vulnerability Checker

PHP versions before 8.5.12, 8.4.27, 8.3.36, and 8.2.35 contain two vulnerabilities that may allow unauthenticated remote code execution. This tool checks a PHP version string for affected upstream releases and specific Ubuntu backports...

Magento Open Source 2.4.9-2026-aug Template Engine Remote Code Execution

Magento Open Source versions through 2.4.9-2026-aug contain an unauthenticated template engine flaw that can allow arbitrary code execution. The included proof of concept uses GraphQL requests to trigger the issue. https://packetstorm.news/download/237645...

Tenable Security Center Multiple Vulnerabilities (TNS-2026-30)

According to its self-reported version, the Tenable Security Center running on the remote host is 6.9.1 or earlier and missing security patch SC-202610.2. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2026-30 advisory. - PHP uses longjmp for out-of-memory OOM...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: php (UTSA-2026-146096)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146096 advisory. PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario...

F5 Networks BIG-IP : PHP vulnerabilities (K000163821)

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.3.7 / 17.5.1.11 / 21.1.0.4 / Hotfix- BIGIP-17.1.3.6.0.9.20-ENG / Hotfix-BIGIP-17.5.1.10.0.37.35-ENG. It is, therefore, affected by multiple vulnerabilities as referenced in the K000163821 advisory. CVE-2026-109618also...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: php (UTSA-2026-146100)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146100 advisory. PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after bei...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: php (UTSA-2026-146102)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146102 advisory. PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after bei...