FreeBSD : brotli -- out-of-bounds write permits remote code execution (f1e61d76-cdb6-11f1-b15e-589cfc104230)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the f1e61d76-cdb6-11f1-b15e-589cfc104230 advisory. -Brotli project reports: CVE-2026-111497: out-of-bounds write permits remote code execution. Tenable ha...

Important: php

Issue Overview: A flaw was found in pcre2. When an application processes attacker-controlled regular expressions using certain Just-In-Time JIT compiler interfaces, an out-of-bounds write with arbitrary data can occur. An attacker could exploit this vulnerability to achieve arbitrary code...

PT-2026-121320

On October 21, 2026, two critical remote code execution RCE vulnerabilities, collectively known as "PHP2Shell", were disclosed in the PHP core. These vulnerabilities exploit a heap use-after-free UAF condition in PHP's session upload progress mechanism, enabling unauthenticated remote code...

KLA91370 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information. Below is a complete list of vulnerabilities: 1. A remote code execution...

PT-2026-121647

Name of the Vulnerable Software and Affected Versions AOS-10 affected versions not specified Description A buffer overflow occurs in the API of AOS-10, which may allow an authenticated adjacent attacker with high privileges to achieve remote code execution. A buffer overflow is a condition where ...

PT-2026-121637

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A flaw in the web-based management interface of wireless network management systems allows an authenticated remote attacker to execute remote code. This could le...

PT-2026-121640

Name of the Vulnerable Software and Affected Versions AOS-8 affected versions not specified Description A buffer overflow in the PAPI protocol allows an authenticated remote attacker with high privileges to execute arbitrary code as a privileged user on the underlying operating system. A buffer...

PT-2026-121667

Name of the Vulnerable Software and Affected Versions Azure Pipelines affected versions not specified Description Improper neutralization of special elements used in a command, known as command injection, allows an unauthorized attacker to execute code over a network. Recommendations At the momen...

PT-2026-121485

Name of the Vulnerable Software and Affected Versions Black versions prior to 26.10.1 Description The Black GitHub Action allows remote code execution when the use pyproject setting is enabled. The action reads the tool.black.required-version variable from the pyproject.toml file without validati...

PT-2026-121343

FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design save svg operation that allows unauthenticated attackers to write arbitrary files via the filePath parameter. Attackers can send a POST request with directory traversal sequences in filePath and a CONTENT...

PT-2026-121399

Name of the Vulnerable Software and Affected Versions EmberZNet versions prior to 9.1.2 Description A malformed Publish Price Matrix command can cause an out-of-bounds write, which may allow remote code execution. This issue specifically affects devices that support the Price Cluster and requires...

PT-2026-121418

An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitrary code via a crafted OAuth authorization URL with an arbitrary redirect uri...

PT-2026-121395

In EmberZNet 9.1.1 and earlier, a malformed Simple Desc req response can result in an out-of-bounds write potentially leading to remote code execution. This response must come from a device that has already joined the network, and the attacker must wait for a Simple Desc req before the attack can...

WordPress 7.0.1 Remote Code Execution

WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 contain a REST API batch route-confusion flaw and a WPQuery SQL injection flaw that can be chained for unauthenticated remote code execution. https://packetstorm.news/download/237062...

PHP 8.5.11 php2shell Vulnerability Scanner

PHP versions 5.4.0 through 8.5.11 contain two remote code execution flaws involving request parsing state. The supplied tool fingerprints targets and can send active validation probes...

PHP 8.5.11 / 8.4.26 / 8.3.35 / 8.2.34 Remote Code Execution Scanner

PHP versions before 8.5.12, 8.4.27, 8.3.36, and 8.2.35 contain vulnerabilities that may allow unauthenticated remote code execution. This tool passively identifies exposed PHP versions from server responses, local settings, supplied phpinfo data, and optional Shodan historical banners...

PHP 8.5.11 Remote Code Execution

PHP versions through 8.5.11 contain out-of-memory corruption and stale global-state flaws that can result in unauthenticated remote code execution when processing web requests...

PHP 8.5.11 php2shell Patch-Level Verification Tool

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain an out-of-memory handling flaw that can lead to remote code execution. This tool performs host-side patch and configuration checks, or non-destructive external header reconnaissance...

Apache Struts 2.5.10 Remote Code Execution

Apache Struts versions 2.3.0 through 2.3.31 and 2.5.0 through 2.5.10 contain a remote code execution vulnerability in Jakarta Multipart parser error handling. This report provides defensive analysis, incident-response guidance, and remediation recommendations...

PHP 8.5.11 Remote Code Execution Checker

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain remote code execution vulnerabilities. This tool identifies vulnerable PHP installations on hosts and running Docker containers...