PT-2026-121637

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A flaw in the web-based management interface of wireless network management systems allows an authenticated remote attacker to execute remote code. This could le...

PT-2026-121629

Name of the Vulnerable Software and Affected Versions AOS-8 affected versions not specified Description Command injection flaws exist that allow unauthenticated remote code execution. An attacker can achieve this by sending specially crafted PAPI packets, enabling the execution of arbitrary code ...

CVE-2026-51954

An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitrary code via a crafted OAuth authorization URL with an arbitrary redirecturi...

CVE-2021-48014: Improper Limitation of a Pathname to a Restricted Directory

FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer designsavesvg operation that allows unauthenticated attackers to write arbitrary files via the filePath parameter. Attackers can send a POST request with directory traversal sequences in filePath and a CONTENT...

PHP 8.5.11 Remote Code Execution Exposure Checker

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain out-of-memory corruption and stale global-state vulnerabilities that may allow unauthenticated remote code execution. The tool checks local configuration or triages an authorized remote host...

PHP 8.5.11 Remote Code Execution

PHP version 8.5.11 and prior affected versions contain use-after-free vulnerabilities that can lead to unauthenticated remote code execution. This proof of concept targets PHP 8.4.26 with Apache modphp prefork. https://packetstorm.news/download/237019...

PT-2026-125753

Уязвимость локально развёртываемой версии оркестратора VeloCloud Orchestrator VCO On-Prem платформы управления программно-конфигурируемыми сетями VMware SD-WAN by VeloCloud связана с непринятием мер по защите структуры запроса SQL. Эксплуатация уязвимости может позволить нарушителю, действующему...

VulnCheck KEV: CVE-2021-48014

FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer designsavesvg operation that allows unauthenticated attackers to write arbitrary files via the filePath parameter. Attackers can send a POST request with directory traversal sequences in filePath and a CONTENT...

Apache Log4j 2.14.1 JNDI Remote Code Execution

Apache Log4j versions 2.0-beta9 through 2.14.1 contain a JNDI lookup vulnerability that may allow remote code execution when attacker-controlled input is logged...

PT-2026-121399

Name of the Vulnerable Software and Affected Versions EmberZNet versions prior to 9.1.2 Description A malformed Publish Price Matrix command can cause an out-of-bounds write, which may allow remote code execution. This issue specifically affects devices that support the Price Cluster and requires...

PHP 8.5.11 / 8.4.26 / 8.3.35 / 8.2.34 Remote Code Execution

PHP versions before 8.5.12, 8.4.27, 8.3.36, and 8.2.35 contain out-of-memory corruption and stale request-owned global state flaws that can allow unauthenticated remote code execution. This submission provides vulnerability information and cPanel EasyApache 4 partial mitigation guidance...

PHP 5.3.29 / 5.4.16 / 7.3.33 Remote Code Execution

PHP versions 5.3.29, 5.4.16, and 7.3.33 backport minimal mitigations for remote code execution issues caused by out-of-memory corruption and stale global state...

PHP 8.5.11 Remote Code Execution Checker

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain remote code execution vulnerabilities. This tool identifies vulnerable PHP installations on hosts and running Docker containers...

PT-2026-121395

In EmberZNet 9.1.1 and earlier, a malformed Simple Desc req response can result in an out-of-bounds write potentially leading to remote code execution. This response must come from a device that has already joined the network, and the attacker must wait for a Simple Desc req before the attack can...

PHP OOM and Stale Global State Verification

PHP versions prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain OOM corruption and stale global state flaws that can enable remote code execution. This tool provides local condition-verification harnesses...

PHP 8.5.11 php2shell Patch-Level Verification Tool

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain an out-of-memory handling flaw that can lead to remote code execution. This tool performs host-side patch and configuration checks, or non-destructive external header reconnaissance...

Microsoft Windows Print Spooler Remote Code Execution

Microsoft Windows Print Spooler contains a remote code execution vulnerability that allows an authenticated attacker to install a malicious printer driver and execute code with SYSTEM privileges...

PT-2026-121320

On October 21, 2026, two critical remote code execution RCE vulnerabilities, collectively known as "PHP2Shell", were disclosed in the PHP core. These vulnerabilities exploit a heap use-after-free UAF condition in PHP's session upload progress mechanism, enabling unauthenticated remote code...

PT-2026-121343

FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design save svg operation that allows unauthenticated attackers to write arbitrary files via the filePath parameter. Attackers can send a POST request with directory traversal sequences in filePath and a CONTENT...

Apache Struts 2.5.10 Remote Code Execution

Apache Struts versions 2.3.0 through 2.3.31 and 2.5.0 through 2.5.10 contain a remote code execution vulnerability in Jakarta Multipart parser error handling. This report provides defensive analysis, incident-response guidance, and remediation recommendations...