CVE-2026-100358 SuiteCRM: Admin OS RCE via Dropdown Editor PHP Injection

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the Studio Dropdown Editor passes $dropdownname through htmlentitydecode and writes the result verbatim into a PHP language file under custom/ that is included on...

Security Bulletin: IBM QRadar SIEM contains PHP components with known vulnerabilities

Summary IBM QRadar SIEM contains versions of PHP vulnerable to PHP2Shell vulnerabilities. This bulletin contains mitigations for QRadar SIEM systems. Vulnerability Details CVEID:CVE-2026-109618 DESCRIPTION: PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handli...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

CVE-2026-109619: PHP stale session state, isolated lab reprodu...

scanner-cli

Deprecation Notice: Hawkeye has reached its end of life. There are more modern options out there for you and your project. If you wish to pick up maintenance of the project, please feel free to contact me. You'll find means of reaching out to me on my personal homepage. . . . . . . The Hawkeye...

D-Link DAR-8000-10 - Command Injection

D-Link DAR-8000-10 version has an operating system command injection vulnerability. The vulnerability originates from the parameter id of the file /app/sys1.php which can lead to operating system command injection. id: CVE-2023-4542 info: name: D-Link DAR-8000-10 - Command Injection author:...

Juniper Devices - Remote Code Execution

Multiple cves in Juniper Network CVE-2023-36844|CVE-2023-36845|CVE-2023-36846|CVE-2023-36847.A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environments variables...

Ads Pro Plugin <= 4.89 - Local File Inclusion

The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.89 via the 'bsatemplate' parameter of the bsapreviewcallback function. This makes it possible for unauthenticated attackers to includ...

Yii2 PHP Framework < 2.0.52 - Remote Code Execution

Yii2 PHP Framework before 2.0.52 is vulnerable to remote code execution via improper validation of the class key in JSON behaviors. An attacker can instantiate arbitrary PHP classes and achieve RCE. id: CVE-2024-58136 info: name: Yii2 PHP Framework 2.0.52 - Remote Code Execution author:...

PHP2Shell (CVE-2026-109618/CVE-2026-109619) - Active Crash Detection

PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may re...

uWSGI PHP Plugin Local File Inclusion

uWSGI PHP Plugin before 2.0.17 mishandles a DOCUMENTROOT check during use of the --php-docroot option, making it susceptible to local file inclusion. id: CVE-2018-7490 info: name: uWSGI PHP Plugin Local File Inclusion author: madrobot severity: high description: uWSGI PHP Plugin before 2.0.17...

[SECURITY] [DSA 6612-1] symfony security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6612-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff November 04, 2026 https://www.debian.org/security/faq -...

php-malware-finder

PHP Malware Finder | || || || | | | | || || | | || || || | Webshell finder, | || || | kiddies hunter, | | | |||| || | website cleaner. || || |||| Detect potentially malicious PHP files. What does it detect? PHP-malware-finder does its very best to detect obfuscated/dodgy code as well as files usi...

Security Bulletin: IBM TS4300 3U Tape Library is vulnerable to remote code execution (CVE-2026-109618, CVE-2026-109619)

Summary IBM TS4300 3U Tape Library is vulnerable to remote code execution. Vulnerability Details CVEID:CVE-2026-109618 DESCRIPTION: PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

Cloudflare PHP CTF — php2shell WAF-bypass research Target:...

SUSE-SU-2026:3509-1 Security update for php8

This update for php8 fixes the following issues: Update to version 8.3.33. Security issues fixed: - CVE-2026-7260: circular symbolic links in phar archives can lead to unbounded recursion and cause C stack exhaustion bsc1273077. - CVE-2026-9672: security issues in libgd bsc1273078. -...

CVE-2026-121925

A stack-based buffer overflow in libsnowflakeclient and the Snowflake PHP PDO Driver could, under specific conditions, result in memory corruption during SAML-based authentication. During a native SSO/SAML login flow, the affected drivers may have copied a value taken from the identity provider's...

EUVD-2026-116886

A stack-based buffer overflow in libsnowflakeclient and the Snowflake PHP PDO Driver could, under specific conditions, result in memory corruption during SAML-based authentication. During a native SSO/SAML login flow, the affected drivers may have copied a value taken from the identity provider's...

CVE-2026-121925 Buffer overflow in SAML authentication post-back URL handling in libsnowflakeclient and Snowflake PHP PDO Driver

A stack-based buffer overflow in libsnowflakeclient and the Snowflake PHP PDO Driver could, under specific conditions, result in memory corruption during SAML-based authentication. During a native SSO/SAML login flow, the affected drivers may have copied a value taken from the identity provider's...

CVE-2026-121925

A stack-based buffer overflow exists in libsnowflakeclient and the Snowflake PHP PDO Driver during SAML-based authentication. The vulnerability occurs because the drivers may copy a value from an identity provider's HTML response into a fixed-size memory buffer without validating its length. This...

CVE-2026-121925 Buffer overflow in SAML authentication post-back URL handling in libsnowflakeclient and Snowflake PHP PDO Driver

A stack-based buffer overflow in libsnowflakeclient and the Snowflake PHP PDO Driver could, under specific conditions, result in memory corruption during SAML-based authentication. During a native SSO/SAML login flow, the affected drivers may have copied a value taken from the identity provider's...