Black: GitHub Action installs unvalidated required-version from pyproject.toml

Summary The GitHub Action bundled with Black can read the version from tool.black.required-version if usepyproject is set to True. This version is not validated and therefore can be used to execute untrusted code in the context of a victim's repository. Details This is similar to the previous...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php2shell-ioc Were you hit by PHP2Shell? A read-only triage...

CVE-2026-51954

An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitrary code via a crafted OAuth authorization URL with an arbitrary redirecturi...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

PHP2Shell CVE-2026-109618 / CVE-2026-109619 Two critica...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

CVE-2026-109618-POC Multipart OOM bailout corruption trigger...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php2shell Check websites and servers for PHP2Shell CVE-2026...

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

Impact A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution RCE when Next.js runs on glibc-based Linux. Workaround Ensure the version of sharp used by Next.js is greater than or equal to 0.35.5. Fresh...

npm: Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

npm: Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used vulnerability discovered by ? in WordPress npm next versions = 10.0.0, = 15.5.27...

Dependency on Vulnerable Third-Party Component

Overview next is a react framework. Affected versions of this package are vulnerable to Dependency on Vulnerable Third-Party Component via the sharp image processing dependency used by next/image. A vulnerable version of sharp is bundled as an optional dependency, and an attacker can exploit a fl...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

Testeur CVE-2026-109618 / CVE-2026-109619 php2shell Un scri...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php2shell — Refactored POC for CVE-2026-109618 / CVE-2026-1096...

OESA-2026-4423 kafka security update

Apache Kafka is an open-source distributed event streaming platform used by thousands of companies for high-performance data pipelines, streaming analytics, data integration, and mission-critical applications. Security Fixes: JMSSink in all versions of Log4j 1.x is vulnerable to deserialization o...

OESA-2026-4422 kafka security update

Apache Kafka is an open-source distributed event streaming platform used by thousands of companies for high-performance data pipelines, streaming analytics, data integration, and mission-critical applications. Security Fixes: JMSSink in all versions of Log4j 1.x is vulnerable to deserialization o...

OESA-2026-4421 kafka security update

Apache Kafka is an open-source distributed event streaming platform used by thousands of companies for high-performance data pipelines, streaming analytics, data integration, and mission-critical applications. Security Fixes: JMSSink in all versions of Log4j 1.x is vulnerable to deserialization o...

OESA-2026-4420 kafka security update

Apache Kafka is an open-source distributed event streaming platform used by thousands of companies for high-performance data pipelines, streaming analytics, data integration, and mission-critical applications. Security Fixes: JMSSink in all versions of Log4j 1.x is vulnerable to deserialization o...

OESA-2026-4414 php security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

OESA-2026-4413 php security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

OESA-2026-4411 php security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

OESA-2026-4412 php security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

CVE-2026-94502

In EmberZNet 9.1.1 and earlier, a malformed Publish Price Matrix command can result in an out-of-bounds write potentially leading to remote code execution. These messages must come from a device that has already joined the network. Only devices supporting the Price Cluster are impacted...