Amazon Linux 2023 : php8.3, php8.3-bcmath, php8.3-cli (ALAS2023-2026-3302)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3302 advisory. PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory i...

Rocky Linux 10.2 [CIQ] Security Update: aspnetcore-runtime-9.0 / aspnetcore-runtime-dbg-9.0 / etc Multiple Vulnerabilities (crlsa-2026_86172)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202686172 advisory. dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability CVE-2026-58280 dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Informatio...

Amazon Linux 2 : php (ALASPHP8.2-2026-015)

The version of php installed on the remote host is prior to 8.2.35-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2PHP8.2-2026-015 advisory. A flaw was found in pcre2. When an application processes attacker-controlled regular expressions using certain...

Rocky Linux 8 [CIQ] Security Update: aspnetcore-runtime-8.0 / aspnetcore-runtime-dbg-8.0 / etc Multiple Vulnerabilities (crlsa-2026_86594)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202686594 advisory. dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability CVE-2026-58280 dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information...

Amazon Linux 2023 : php8.2, php8.2-bcmath, php8.2-cli (ALAS2023-2026-3301)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3301 advisory. PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory i...

Node.js 22.x < 22.23.4 / 24.x < 24.22.1 / 26.x < 26.12.1 Multiple Vulnerabilities

The version of Node.js installed on the remote host is 22.x prior to 22.23.4, 24.x prior to 24.22.1, or 26.x prior to 26.12.1. It is, therefore, affected by multiple vulnerabilities as referenced in the Wednesday, October 21, 2026 Security Releases advisory. - An out-of-bounds write in the Brotli...

HPE ArubaOS security vulnerabilities

A security vulnerability exists in HPE ArubaOS. It stems from a remote code execution flaw in the web interface, allowing unauthenticated remote attackers to launch attacks. This could result in full control over the device, interception of network traffic, and potential damage to connected syste...

HPE ArubaOS security vulnerabilities

A security vulnerability exists in HPE ArubaOS. It stems from a memory corruption flaw in affected interfaces. Unauthenticated neighboring attackers can exploit this vulnerability to achieve remote code execution, allowing arbitrary code to be executed by the underlying operating system as a...

HPE ArubaOS security vulnerabilities

A security vulnerability exists in HPE ArubaOS. It stems from a remote code execution flaw in the underlying operating system. Unauthenticated neighboring attackers can execute arbitrary code on affected devices. Successful exploitation allows attackers to run arbitrary commands with privileged...

PHP 8.5.11 OOM Handling Remote Code Execution

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain out-of-memory handling flaws. This proof of concept sends multipart uploads to reach an OOM path and demonstrates a session-lock leak and worker denial of service in a local PHP 8.4.24 lab. https://packetstorm.news/download/237021...

PHP 8.5.11 Multipart Remote Code Execution

PHP version 8.5.11 contains multipart parsing vulnerabilities that can lead to remote code execution. This package provides a lab proof of concept and validation tooling. https://packetstorm.news/download/236978...

PHP 8.4.26 session.upload_progress Remote Code Execution

PHP version 8.4.26 with Apache modphp contains a session.uploadprogress stale-pointer condition that can be exploited remotely without authentication to leak memory and execute commands. This proof of concept targets a pinned Docker image. https://packetstorm.news/download/236989...

PHP 8.5.11 Remote Code Execution

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain an out-of-memory request parsing vulnerability that can lead to remote code execution. The included proof of concept targets Apache modphp using multipart form input and session upload progress handling...

PHP 8.5.11 Session Upload Progress Remote Code Execution

PHP version 8.5.11 contains a use-after-free in session upload progress handling that can lead to remote code execution. This proof of concept targets an isolated local Apache container. https://packetstorm.news/download/236991...

PT-2026-121320

On October 21, 2026, two critical remote code execution RCE vulnerabilities, collectively known as "PHP2Shell", were disclosed in the PHP core. These vulnerabilities exploit a heap use-after-free UAF condition in PHP's session upload progress mechanism, enabling unauthenticated remote code...

VulnCheck KEV: CVE-2021-48014

FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer designsavesvg operation that allows unauthenticated attackers to write arbitrary files via the filePath parameter. Attackers can send a POST request with directory traversal sequences in filePath and a CONTENT...

Drupal Patreon security vulnerability

A security vulnerability exists in Drupal Patreon version 7.x. It stems from an unknown error that allows remote administrators to pass specially crafted input to the application, thereby executing arbitrary code on the system...

CentOS Linux 7 [TuxCare] Security Update: gstreamer1-plugins-bad-free / gstreamer1-plugins-bad-free-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1792562667)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1792562667 advisory. - GStreamer JPEG Parser Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to...

PT-2026-125753

Уязвимость локально развёртываемой версии оркестратора VeloCloud Orchestrator VCO On-Prem платформы управления программно-конфигурируемыми сетями VMware SD-WAN by VeloCloud связана с непринятием мер по защите структуры запроса SQL. Эксплуатация уязвимости может позволить нарушителю, действующему...

PHP 8.5.11 Remote Code Execution

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain OOM-corruption and stale-global-state flaws that can lead to remote code execution. This proof of concept supplies local-lab reproduction, OOM probes, and version detection. https://packetstorm.news/download/237027...