CVE-2019-11043

CVE-2019-11043 0th3rs Security Team ====================== In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 Tested under PHP 7.2.20/7.3.10 Instructions 1、较为稳定,只要爆破出query长度和Header头字段长度 2、autosession检测漏洞存在性 3、实现判断目标worker进程数实现健壮性 4、全worker进程污染 Nginx configuration locati...

nginx-map-risk-audit

CVE-2026-42533: NGINX Map Regex Risk Review Defensive research note on CVE-2026-42533, a heap buffer overflow in NGINX request processing tied to map directives with regex captures and certain variable evaluation patterns. In plain English: NGINX is web server and reverse proxy software. It often...

CVE-2019-11043

CVE-2019-11043 0th3rs Security Team ====================== In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 Tested under PHP 7.2.20/7.3.10 Instructions 1、较为稳定,只要爆破出query长度和Header头字段长度 2、autosession检测漏洞存在性 3、实现判断目标worker进程数实现健壮性 4、全worker进程污染 Nginx configuration locati...

CVE-2026-90872

Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an authenticated Manager administrator to execute arbitrary commands with the privileges of the WSFTP...

CVE-2026-90872

Progress Software WS_FTP Server on Windows (versions prior to 2024.0.7 and 2025.0.4 ) is vulnerable to an improper neutralization of directives in dynamically evaluated code within the Manager web console . This flaw allows an authenticated Manager administrator to execute arbitrary commands with...

CVE-2026-90872 Server-Side Script Injection in Manager Web UI in Progress WS_FTP Server

Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an authenticated Manager administrator to execute arbitrary commands with the privileges of the WSFTP...

EUVD-2026-113184

Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an authenticated Manager administrator to execute arbitrary commands with the privileges of the WSFTP...

CVE-2026-90872: Progress Software WS_FTP Server: Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software…

Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an authenticated Manager administrator to execute arbitrary commands with the privileges of the WSFTP...

Exploit for CVE-2026-15176

CVE-2026-15176 — NGINX alias + rewrite Heap Overflow: Anal...

CVE-2026-116811

OpenPanel versions before 3.0.0 are vulnerable to a sandbox escape leading to Remote Code Execution (RCE) within the worker process. The flaw exists in the js-runtime validator , where a project member can bypass the AST allowlist by aliasing the Function constructor . Specifically, an attacker w...

CVE-2026-116811 OpenPanel before 3.0.0 Sandbox Escape RCE via Webhook JavaScript Template

OpenPanel before 3.0.0 contains a sandbox escape vulnerability in the js-runtime validator that allows a project member to bypass the AST allowlist by aliasing the Function constructor. Attackers with write access can read payload.constructor.constructor into a local and call it to run arbitrary...

CVE-2026-116811 OpenPanel before 3.0.0 Sandbox Escape RCE via Webhook JavaScript Template

OpenPanel before 3.0.0 contains a sandbox escape vulnerability in the js-runtime validator that allows a project member to bypass the AST allowlist by aliasing the Function constructor. Attackers with write access can read payload.constructor.constructor into a local and call it to run arbitrary...

php: fatal error handling retains stale request state leading to use-after-free

A flaw was found in PHP's error handling and worker process state management. PHP contains error handling, object, and extension state that is retained by the process but points to memory owned by a single request. A fatal error can interrupt an operation or cleanup phase before that state is...

DEBIAN-CVE-2026-114457

A flaw was found in modqos. An unauthenticated remote attacker could cause a Denial of Service DoS by sending a specially crafted JSON request when JSON body filtering is enabled. Due to improper string termination during the processing of percent-encoded input, the module reads past allocated...

CVE-2026-114457

A flaw was found in modqos. An unauthenticated remote attacker could cause a Denial of Service DoS by sending a specially crafted JSON request when JSON body filtering is enabled. Due to improper string termination during the processing of percent-encoded input, the module reads past allocated...

EUVD-2026-108021

A flaw was found in modqos. An unauthenticated remote attacker could cause a Denial of Service DoS by sending a specially crafted JSON request when JSON body filtering is enabled. Due to improper string termination during the processing of percent-encoded input, the module reads past allocated...

php: fatal error handling retains stale request state leading to use-after-free

A flaw was found in PHP's error handling and worker process state management. PHP contains error handling, object, and extension state that is retained by the process but points to memory owned by a single request. A fatal error can interrupt an operation or cleanup phase before that state is...

CVE-2026-114457

A flaw was found in modqos. An unauthenticated remote attacker could cause a Denial of Service DoS by sending a specially crafted JSON request when JSON body filtering is enabled. Due to improper string termination during the processing of percent-encoded input, the module reads past allocated...

NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks

NGINX released versions 1.30.6 and 1.31.7 on October 14 to fix five vulnerabilities, one of them present in every release since May 2005. There are three memory bugs that F5, the company behind NGINX, says could crash a worker process or possibly let an attacker run code, and each requires a...

SUSE CVE-2026-48801

linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has ON^2 algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level scan loop re-slices input and re-runs...