Apache Karaf Cellar 4.4.8 Remote Code Execution

Summary Apache Karaf Cellar is a complete clustering solution for Apache Karaf Container. Cellar can be directly installed on running Karaf Container instances. Description Apache Karaf Cellar suffers from an unauthenticated cluster-join vulnerability leading to remote code execution. The default...

Amazon Linux 2 : bind (ALAS-2026-4038)

The version of bind installed on the remote host is prior to 9.11.4-26.P2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4038 advisory. Inbound-message resource exhaustion CWE-400 leading to denial of service. No configuration precondition; version...

Important: brotli

Issue Overview: A vulnerability in the Node.js Brotli decoder can result in an out-of-bounds memory write when processing crafted Brotli input. Successful exploitation may lead to memory corruption and remote code execution. CVE-2026-111497 Affected Packages: brotli Issue Correction: Run dnf upda...

PHP Session Upload Progress Remote Code Execution

PHP session upload progress can permit attacker-controlled object deserialization when an application uses phpbinary or phpserialize and switches to the php serializer before sessionstart. Included proof of concept demonstrates the serializer-switch condition and a session-file LFI lab...

PHP 8.5.11 PHP2Shell Scanner

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain memory-handling flaws that can allow unauthenticated remote code execution. This tool sends multipart request probes and identifies susceptible targets from crash signals or the X-Powered-By version...

SonicWall SMA1000 12.5.0 OS Command Injection

SonicWall SMA1000 versions 12.4.3-03526 and earlier and 12.5.0-02952 and earlier contain an authenticated administrator OS command injection vulnerability that may result in remote code execution...

Amazon Linux 2 : ghostscript (ALAS-2026-4034)

The version of ghostscript installed on the remote host is prior to 9.54.0-9. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4034 advisory. A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the...

PHP Session Upload Progress Mitigation

A Bash utility that audits common PHP configuration layouts and can disable session upload progress as a temporary mitigation for an unlikely remote code execution vector...

PT-2026-122495

Name of the Vulnerable Software and Affected Versions Prime Mover versions prior to 2.2.2 Description An unauthenticated attacker can perform PHP Object Injection by submitting a crafted, base64-encoded serialized object through the standard comment-submission endpoint 'wp-comments-post.php', whi...

Exploit for CVE-2026-102256

sonicwall-sma1000-cve-2026-102256-check Sta...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

PHP2Shell Labs Is your server exposed to PHP2Shell? PHP2Shel...

php: fatal error handling retains stale request state leading to use-after-free

A flaw was found in PHP's error handling and worker process state management. PHP contains error handling, object, and extension state that is retained by the process but points to memory owned by a single request. A fatal error can interrupt an operation or cleanup phase before that state is...

php: fatal error handling retains stale request state leading to use-after-free

A flaw was found in PHP's error handling and worker process state management. PHP contains error handling, object, and extension state that is retained by the process but points to memory owned by a single request. A fatal error can interrupt an operation or cleanup phase before that state is...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php2shell-fix !checkshttps://github.com/sanketkokate712/p...

PHP2SHELL-POC

PHP2Shell — Vulnerability Research & Lab Analysis Research...

CVE-2026-115812

Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to execute arbitrary code via a crafted model archive. Multi Model Server is end of life and no fixed version is available. Users should discontinue use o...

Exploit for CVE-2026-106173

CVE-2026-106173: Fortinet FortiSIEM gRPC Path Traversal File W...

Metasploit Wrap Up: Langflow, MongoDB, and More

This release adds multiple new modules, and 6 of those modules point at a single target: Langflow, the open-source LLM workflow builder. Together they cover an authentication bypass CVE-2026-93680, 3 unauthenticated remote code execution paths CVE-2026-0768, CVE-2026-0769, and CVE-2026-10134, and...

GHSA-FQ6X-J3G6-XX83 @rog0x/mcp-docker-tools: executes arbitrary code via the handleImageList function

An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function...

@rog0x/mcp-git-tools executes arbitrary code via the resolveBaseBranch function

An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function...