php2shell-check

php2shell-check A read-only triage script for WordPress sites after PHP2Shell CVE-2026-109618 and CVE-2026-109619, the pair of critical remote code execution bugs in the PHP engine disclosed on October 21, 2026. Patching PHP closes the door, but Amazon's honeypots logged an exploitation attempt o...

Updated bind package fixes security vulnerabilities

In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during...

MGASA-2026-0541 Updated bind package fixes security vulnerabilities

In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php-radar php-radar finds PHP you did not know you were runni...

Apache OFBiz Directory Traversal - Remote Code Execution

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.13 id: CVE-2024-32113 info: name: Apache OFBiz Directory Traversal - Remote Code Execution author: DhiyaneshDK severity: high description: |...

CVE-2020-0796-RCE-POC

CVE-2020-0796 Remote Code Execution POC c 2020 ZecOps, Inc. - https://www.zecops.com - Find Attackers' Mistakes Remote Code Execution POC for CVE-2020-0796 / "SMBGhost" Expected outcome: Reverse shell with system access. Intended only for educational and testing in corporate environments. ZecOps...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php2shell-migration A skill for AI coding agents that finds...

PT-2026-122954

CVE-2026-429016 RCE remote cum execution found! ! ! guys update your balls before it's too late!...

NetScaler ADC and Gateway 14.1-73.36 Remote Code Execution

NetScaler ADC and Gateway versions before 14.1-73.37 and 13.1-64.23 contain an unauthenticated remote code execution vulnerability due to improper input validation...

PHP 8.3.30 Remote Code Execution

PHP version 8.3.30 contains out-of-memory handling and stale request-state flaws that can lead to remote code execution. PHP version 8.3.36 fixes the issues...

Citrix NetScaler ADC and Gateway 14.1-73.36 DTLS Configuration Check

Citrix NetScaler ADC and Gateway versions before 14.1-73.37 and 13.1-64.23 contain a DTLS-enabled memory overflow vulnerability that may lead to remote code execution or denial of service. This tool evaluates reported builds and exported DTLS configuration offline...

Google Brotli 1.2.0 Decoder Out-of-Bounds Write

Google Brotli versions 1.0.3 through 1.2.0 contain an out-of-bounds write in the decoder that may allow memory corruption, denial of service, information disclosure, or remote code execution via crafted compressed input...

GitLab 19.5.0 Integer Overflow Detection Tool

This tool assesses GitLab CE/EE version exposure to an integer overflow that can permit unauthenticated remote code execution and triages local exception logs for related indicators...

Amazon Linux 2023 : ghostscript, ghostscript-gtk, ghostscript-tools-dvipdf (ALAS2023-2026-3294)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3294 advisory. A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell commands in the context of the...

Amazon Linux 2023 : brotli, brotli-devel, libbrotli (ALAS2023-2026-3334)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3334 advisory. A vulnerability in the Node.js Brotli decoder can result in an out-of-bounds memory write when processing crafted Brotli input. Successful exploitation may lead to memory corruption and remote code...

Amazon Linux 2023 : bind, bind-chroot, bind-devel (ALAS2023-2026-3312)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3312 advisory. Inbound-message resource exhaustion CWE-400 leading to denial of service. No configuration precondition; version applicability is the deciding factor. Affected versions: 9.11.0-9.18.50,...

FreeBSD : Node.js -- multiple vulnerabilities (33a752ba-4cbe-46d8-abda-587011d90575)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 33a752ba-4cbe-46d8-abda-587011d90575 advisory. Node.js reports: dns.resolve truncates names containing NUL char CVE-2026-105482 - high TLS...

Next.js 16.4.0 use cache Typed Array Remote Code Execution

Next.js version 16.4.0 use cache functions returning multiple typed arrays contain a React Flight framing flaw that can permit unauthenticated remote code execution. The proof of concept demonstrates affected and fixed versions. https://packetstorm.news/download/237482...

n8n 2.36.1 Git Node Remote Code Execution

n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain a remote code execution vulnerability in the Git node. A repository-local Git content-filter configuration can execute a command during a Git operation. https://packetstorm.news/download/237473...

PHP 8.4.27 Session Upload Progress Remote Code Execution

PHP version 8.4.27 and earlier contain a session upload-progress serialization handler mismatch that can allow pre-auth object injection and remote code execution when application code changes the session serialization handler before sessionstart. https://packetstorm.news/download/237461...