PHP 8.5.11 Remote Code Execution

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain remote code execution vulnerabilities caused by out-of-memory corruption and stale global state...

Memory corruption vulnerabilities in PHP

Overview Two memory-related vulnerabilities have been identified in PHP versions prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12. An unauthenticated remote attacker with network access to PHP web services can exploit these vulnerabilities via specially crafted HTTP requests to potentially achieve...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 : Ghostscript vulnerabilities (USN-8949-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8949-1 advisory. Rick de Jager discovered that Ghostscript incorrectly handled memory under certain...

Rocky Linux 9 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_86033)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202686033 advisory. kernel: openvswitch: defer tunnel netdevput to RCU release CVE-2026-31678 kernel: xfrm: espintcp: do not reuse an in-progress partial send CVE-2026-52935...

RHEL 8 : go-toolset:rhel8 (RHSA-2026:87246)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:87246 advisory. Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fixes: golang: net/http:...

AlmaLinux 8 : perl-DBI:1.641 (ALSA-2026:85916)

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:85916 advisory. perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting CVE-2026-88815 Tenable has extracted the preceding description block...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-143078)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-143078 advisory. In the Linux kernel, the following vulnerability has been resolved: mips: sched: Fix CPUMASKOFFSTACK memory corruption This patch addresses a critical memory...

SUSE SLES12: libopenssl-1_0_0-devel / libopenssl-1_0_0-devel-32bit / etc (SUSE-SU-2026:4762-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4762-1 advisory. - CVE-2026-54874: Excessive Memory Use Buffering DTLS Records for a Future Epoch bsc1274795. Changes for openssl-100: - Security fixes in...

AlmaLinux 10 : php (ALSA-2026:87070)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:87070 advisory. php: php: Denial of Service via unbounded recursion in SOAP parser CVE-2026-91765 php: OOM bailout during request parsing leads to memory corruption and...

AlmaLinux 8 : php:7.4 (ALSA-2026:87080)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:87080 advisory. php: php: Out-of-bounds read via empty HTTP redirect Location header CVE-2026-93682 php: PHP: Archive entry injection via integer overflow in TAR parser...

PHP Security Fix Behaviour Check

A shell script that checks a local PHP CLI binary for the out-of-memory termination behavior addressed by PHP security fixes released on 21 October 2026...

PHP 8.5.11 Remote Code Execution Vulnerabilities

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain two unauthenticated remote code execution vulnerabilities involving out-of-memory handling and stale global state. The supplied advisory summarizes affected deployments, mitigations, patch versions, and references...

HPE ArubaOS security vulnerabilities

A security vulnerability exists in HPE ArubaOS. It stems from a memory corruption flaw in services accessed via the PAPI protocol, which may allow unauthenticated remote attackers to launch denial-of-service attacks, thereby compromising the availability of affected services...

HPE ArubaOS security vulnerabilities

A security vulnerability exists in HPE ArubaOS. It stems from a memory corruption flaw that may allow unauthenticated remote attackers to launch denial-of-service attacks, thereby compromising the availability of affected services...

HPE ArubaOS security vulnerabilities

A security vulnerability exists in HPE ArubaOS. It stems from a memory corruption flaw in the web management interface. Authenticated low-privilege attackers with local access can exploit this vulnerability to view certain system files and disrupt the normal operation of affected services...

PHP 5.3.29 php2shell Backport

An unofficial backport for PHP version 5.3.29 applies fixes for out-of-memory bailout and stale request-state vulnerabilities affecting Apache modphp...

HPE ArubaOS security vulnerabilities

A security vulnerability exists in HPE ArubaOS. It stems from a memory corruption flaw in affected interfaces. Unauthenticated neighboring attackers can exploit this vulnerability to achieve remote code execution, allowing arbitrary code to be executed by the underlying operating system as a...

PHP 8.0.30-6 Out-Of-Memory Remote Code Execution

PHP version 8.0.30-6 on EL7 Remi builds is vulnerable to out-of-memory state corruption that can lead to remote code execution. This submission provides a backported mitigation and a Docker proof of concept demonstrating affected session upload progress, local file inclusion, and OOM behavior...

ROS-20261022-73-0075

The vulnerability of the extension unit search mechanism for the UVC H.264 RDP client FreeRDP, related to memory reading beyond the allocated range, allows a perpetrator to access potentially confidential data...

ROS-20261022-73-0057

A vulnerability exists in the proxy server for asynchronous message updates for RAILWINDOWSTATEORDER and NOTIFYICONSTATEORDER in the RDP client FreeRDP. This vulnerability is related to memory usage after deallocation, allowing an attacker to trigger a service failure...