Palo Alto Networks PAN-OS 10.2.x / 11.1.x / 11.2.x / 12.1.x / 12.2.x Multiple Vulnerabilities

The version of Palo Alto Networks PAN-OS running on the remote host is a vulnerable version of 10.2.x, 11.1.x, 11.2.x, 12.1.x, or 12.2.x. It is, therefore, affected by multiple vulnerabilities. Palo Alto Networks is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619...

ROS-20261023-73-0097

The vulnerability in libxml2 is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package

CVE-2026-111497 "Node2Shell" is an out-of-bounds write CWE-787 in Google'sBrotli decoder c/dec/decode.c. DecodeBlockTypeAndLength returns an ambiguousvalue for an invalid block switch, and the fast decode path discards itCWE-252, unchecked return value, so a crafted Brotli stream makes the...

PYSEC-2026-4323 Out-of-bounds write in the brotlicffi decoder ("Node2Shell") also affects the PyPI Brotli package

CVE-2026-111497 "Node2Shell" is an out-of-bounds write CWE-787 in Google's Brotli decoder c/dec/decode.c. DecodeBlockTypeAndLength returns an ambiguous value for an invalid block switch, and the fast decode path discards it CWE-252, unchecked return value, so a crafted Brotli stream makes the...

PYSEC-2026-4322 Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package

CVE-2026-111497 "Node2Shell" is an out-of-bounds write CWE-787 in Google's Brotli decoder c/dec/decode.c. DecodeBlockTypeAndLength returns an ambiguous value for an invalid block switch, and the fast decode path discards it CWE-252, unchecked return value, so a crafted Brotli stream makes the...

PHP 8.4.26 Remote Code Execution

PHP core versions after 5.4 contain a vulnerability that can result in remote code execution. This proof of concept targets PHP version 8.4.26 running as modphp with a prefork Apache configuration. !/usr/bin/env python3 """ Exploit credited to 9bie, adjusted using AI by OffSec php2shell - one-cli...

Brotli Node.js Code Execution

The Brotli data compression algorithm vulnerability in the Node.js software platform is related to a lack of validation on return values. Exploitation of this vulnerability may allow a remote attacker to execute arbitrary code...

Vaadin and the October 2026 Node.js security releases

A deployed Vaadin application does not run Node.js, so it is not exposed to the vulnerabilities fixed in the Node.js security releases of 21 October 2026. Vaadin uses Node.js only to build the frontend and to run development mode, which means the exposure, where there is any, is in build and...

Out-of-bounds write in the brotlicffi decoder ("Node2Shell") also affects the PyPI Brotli package

CVE-2026-111497 "Node2Shell" is an out-of-bounds write CWE-787 in Google'sBrotli decoder c/dec/decode.c. DecodeBlockTypeAndLength returns an ambiguousvalue for an invalid block switch, and the fast decode path discards itCWE-252, unchecked return value, so a crafted Brotli stream makes the...

SUSE CVE-2026-111183

GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary...

SUSE CVE-2026-114094

Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code...

Exploit for CVE-2026-109255

CVE-2026-109255 FreeRDP 3.0.0 before 3.32.0 contains an intege...

cve-2025-24813-poc

CVE-2025-24813 Apache Tomcat RCE Exploit PoC This repository contains a proof-of-concept exploit for CVE-2025-24813, a Java deserialization vulnerability in Apache Tomcat. Based on absholi7ly/POC-CVE-2025-24813/. Prerequisites Docker Setup 1. Install dependencies: uv venv source .venv/bin/activat...

dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability

Improper neutralization of input during web page generation 'cross-site scripting' in ASP.NET Core allows an unauthorized attacker to execute code over a network...

dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability

Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

🛡️ php2shell-enterprise-hardening CVE-2026-109618 / CVE-2026-...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php2shell-lab !buildhttps://github.com/bsalunke/php2shell...

dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability

Improper neutralization of input during web page generation 'cross-site scripting' in ASP.NET Core allows an unauthorized attacker to execute code over a network...

dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability

Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network...

dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability

Improper neutralization of input during web page generation 'cross-site scripting' in ASP.NET Core allows an unauthorized attacker to execute code over a network...