CVE-2026-115933 Forged signed tokens let any registered user take over other users and organizations

Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can...

Exploit for CVE-2026-115560

CVE-2026-115560 — PHP session upload progress serialize-handle...

php2shell-pcaps

PHP2Shell PCAPs Packet captures from the php2shell vulnerabil...

PT-2026-122609

Name of the Vulnerable Software and Affected Versions Postiz affected versions not specified Description Postiz uses a single shared secret to sign session, invitation, and password reset tokens without including a marker to distinguish the token purpose. A route used to refresh browser-extension...

SUSE CVE-2026-98870

In the Linux kernel, the following vulnerability has been resolved: ksmbd: remove stale channels from all sessions on teardown ksmbdsessionsderegister removes a connection's channels from other sessions' channel lists only while conn-binding is still set: if conn-binding...

Exploit for CVE-2026-58040

node-cve-2026-58040-check Standalone...

MAL-2026-18283 Malicious code in @greenlake/session (npm)

@greenlake/session is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 3.0.0, 99.0.1, 1.0.0, 2.0.0 has a postinstall script that runs node beacon.cjs on...

Malicious code in @greenlake/session (npm)

@greenlake/session is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 3.0.0, 99.0.1, 1.0.0, 2.0.0 has a postinstall script that runs node beacon.cjs on...

project2026_20261023_php_rce_guard

php-rce-guard Petit outil PHP, sans dépendance, qui répond à...

Malicious code in sitecard (PyPI)

Source: kam193 49be8995374d0e3d2bcb8f163675221e14bfb6d7d968a6fa5d8165e4f493997d The package provides code to create an SSH session exposed via tunnels. By default, created session is accessible without any auth and reported to a hardcoded location, exposing any user to be accessed by attacker. --...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php2shell-sapi-differential Differential research on CVE-2026...

PHP2SHELL-POC

PHP2Shell — Vulnerability Research & Lab Analysis Research...

Exploit for CVE-2026-115560

PHP Session U...

Malicious code in sitecard (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 49be8995374d0e3d2bcb8f163675221e14bfb6d7d968a6fa5d8165e4f493997d The package provides code to create an SSH session exposed via tunnels. By default, created session is accessible without any auth and reported to a hardcoded...

phptopwn

PHP2Shell Threat-Intelligence Honeypot A safe, high-interacti...

php2shell

php2shell - CVE-2026-109618 & CVE-2026-109619 Testing Environm...

DEBIAN-CVE-2026-99059

In the Linux kernel, the following vulnerability has been resolved: wireguard: noise: reject response consumption after intermediate initiation Two threads begin processing the identical response message, received twice. The first thread, A, runs. While it's running, the second one, B, gets partw...

CVE-2026-99059

In the Linux kernel, the following vulnerability has been resolved: wireguard: noise: reject response consumption after intermediate initiation Two threads begin processing the identical response message, received twice. The first thread, A, runs. While it's running, the second one, B, gets partw...

CVE-2026-99059 wireguard: noise: reject response consumption after intermediate initiation

In the Linux kernel, the following vulnerability has been resolved: wireguard: noise: reject response consumption after intermediate initiation Two threads begin processing the identical response message, received twice. The first thread, A, runs. While it's running, the second one, B, gets partw...

CVE-2026-99059

The Linux kernel contains a vulnerability in the WireGuard noise protocol where two threads may process the same response message simultaneously. A race condition occurs because while thread B is performing a slow calculation, thread A completes and a third thread C initiates a new handshake, res...