CentOS Linux 7 [TuxCare] Security Update: gstreamer1-plugins-base / gstreamer1-plugins-base-devel / etc (CENTOS7:CLSA-2026:1790603589)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1790603589 advisory. - GStreamer OGG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execu...

Brotli Node.js Code Execution

The Brotli data compression algorithm vulnerability in the Node.js software platform is related to a lack of validation on return values. Exploitation of this vulnerability may allow a remote attacker to execute arbitrary code...

PYSEC-2026-4322 Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package

CVE-2026-111497 "Node2Shell" is an out-of-bounds write CWE-787 in Google's Brotli decoder c/dec/decode.c. DecodeBlockTypeAndLength returns an ambiguous value for an invalid block switch, and the fast decode path discards it CWE-252, unchecked return value, so a crafted Brotli stream makes the...

PYSEC-2026-4323 Out-of-bounds write in the brotlicffi decoder ("Node2Shell") also affects the PyPI Brotli package

CVE-2026-111497 "Node2Shell" is an out-of-bounds write CWE-787 in Google's Brotli decoder c/dec/decode.c. DecodeBlockTypeAndLength returns an ambiguous value for an invalid block switch, and the fast decode path discards it CWE-252, unchecked return value, so a crafted Brotli stream makes the...

Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package

CVE-2026-111497 "Node2Shell" is an out-of-bounds write CWE-787 in Google'sBrotli decoder c/dec/decode.c. DecodeBlockTypeAndLength returns an ambiguousvalue for an invalid block switch, and the fast decode path discards itCWE-252, unchecked return value, so a crafted Brotli stream makes the...

Vaadin and the October 2026 Node.js security releases

A deployed Vaadin application does not run Node.js, so it is not exposed to the vulnerabilities fixed in the Node.js security releases of 21 October 2026. Vaadin uses Node.js only to build the frontend and to run development mode, which means the exposure, where there is any, is in build and...

Out-of-bounds write in the brotlicffi decoder ("Node2Shell") also affects the PyPI Brotli package

CVE-2026-111497 "Node2Shell" is an out-of-bounds write CWE-787 in Google'sBrotli decoder c/dec/decode.c. DecodeBlockTypeAndLength returns an ambiguousvalue for an invalid block switch, and the fast decode path discards itCWE-252, unchecked return value, so a crafted Brotli stream makes the...

Palo Alto Networks PAN-OS 10.2.x / 11.1.x / 11.2.x / 12.1.x / 12.2.x Multiple Vulnerabilities

The version of Palo Alto Networks PAN-OS running on the remote host is a vulnerable version of 10.2.x, 11.1.x, 11.2.x, 12.1.x, or 12.2.x. It is, therefore, affected by multiple vulnerabilities. Palo Alto Networks is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619...

AlmaLinux 8 : hplip (ALSA-2026:82295)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:82295 advisory. hplip: potential memory buffer overflow CVE-2020-6923 hplip: HP Linux Imaging and Printing Software - Use of DSA Key CVE-2025-43023 hplip: HPLIP: Multipl...

SUSE SLED15: WebKitGTK-4.0-lang / WebKitGTK-4.1-lang / WebKitGTK-6.0-lang / etc (SUSE-SU-2026:4858-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4858-1 advisory. Security issues fixed: WebKitGTK and WPE WebKit Security Advisory WSA-2026-0006 bsc1284619: - CVE-2024-1283:...

SUSE CVE-2026-111183

GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary...

SUSE CVE-2026-114094

Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code...

Exploit for CVE-2026-109255

CVE-2026-109255 FreeRDP 3.0.0 before 3.32.0 contains an intege...

dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability

Improper neutralization of input during web page generation 'cross-site scripting' in ASP.NET Core allows an unauthorized attacker to execute code over a network...

dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability

Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

🛡️ php2shell-enterprise-hardening CVE-2026-109618 / CVE-2026-...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php2shell-lab !buildhttps://github.com/bsalunke/php2shell...

dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability

Improper neutralization of input during web page generation 'cross-site scripting' in ASP.NET Core allows an unauthorized attacker to execute code over a network...

dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability

Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network...

dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability

Improper neutralization of input during web page generation 'cross-site scripting' in ASP.NET Core allows an unauthorized attacker to execute code over a network...