Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: php (UTSA-2026-146117)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146117 advisory. PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after bei...

KLA91378 Multiple vulnerabilities in Mozilla Firefox ESR

Multiple vulnerabilities were found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information. Below is a complete list of vulnerabilities: 1. A remote code execution...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: php (UTSA-2026-146119)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146119 advisory. PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: php (UTSA-2026-146116)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146116 advisory. PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario...

Google Chrome Vulnerability: CVE-2026-118306

Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

TencentOS Server 3: php:8.2 (TSSA-2026:1209)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1209 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

Security Update for Microsoft .NET Core (October OOB 2026)

The Microsoft .NET Core installations on the remote host are missing a security update. It is, therefore, affected by multiple vulnerabilities as referenced in the vendor advisory. - Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network. CVE-2026-70197 -...

Google Chrome Vulnerability: CVE-2026-118355

Improper input validation in Command in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

WordPress Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin <= 1.0.276 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution vulnerability

Authenticated Contributor+ PHP Object Injection to Remote Code Execution vulnerability discovered by moochi in WordPress Plugin Rank Math SEO versions = 1.0.276...

Google Chrome Vulnerability: CVE-2026-118317

Memory corruption in HTML in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

Google Chrome Vulnerability: CVE-2026-118327

Memory corruption in Media in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

Microsoft Windows SMBv1 Remote Code Execution

This document provides a proof of concept workflow for identifying vulnerable Microsoft Windows SMBv1 hosts and exploiting the MS17-010 EternalBlue vulnerability with Metasploit. https://packetstorm.news/download/237889...

WordPress 7.0.1 REST API Batch Route Confusion Remote Code Execution

WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 contain a REST API batch-route confusion issue which, when combined with SQL injection, can lead to remote code execution. https://packetstorm.news/download/237893...

SPIP 4.4.19 Remote Code Execution

SPIP versions before 4.4.20 contain an unauthenticated remote code execution vulnerability. The supplied proof of concept delivers PHP code through the search parameter and attempts to write command and upload shells to successful targets. https://packetstorm.news/download/237890...

GitLab 19.4.1 CI/CD Regular Expression Remote Code Execution

GitLab versions 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 contain an integer overflow in CI/CD regular expression handling that can allow remote code execution. Includes a proof of concept. https://packetstorm.news/download/237901...

Juniper Junos OS Evolved 25.4 PTX Series Unauthenticated Remote Code Execution

Juniper Junos OS Evolved on PTX Series versions before 25.4R1-S1-EVO and 25.4R2-EVO contain an unauthenticated remote code execution vulnerability. The supplied proof of concept creates and executes a command through the affected configuration API. https://packetstorm.news/download/237898...

SPIP 4.4.19 and Earlier Remote Code Execution

SPIP versions before 4.4.20 contain an unauthenticated remote code execution vulnerability related to PHP block identification and varexport handling. The included proof of concept detects affected targets and deploys command execution and file-upload PHP shells...

PHP 8.5.11 Remote Code Execution

PHP version 8.5.11 contains an out-of-memory handling flaw that can result in remote code execution. The included proof of concept targets Apache modphp prefork deployments using multipart requests and session-state disclosure. https://packetstorm.news/download/237867...

Kestra 1.3.20 Authentication Bypass / Remote Code Execution

Kestra version 1.3.20 contains an authentication-filter bypass that permits unauthenticated workflow creation and execution through a path ending in /configs, resulting in command execution inside the worker container. https://packetstorm.news/download/237872...

PHP 8.5.11 Session Upload Progress Remote Code Execution

PHP versions through 8.5.11 contain session.uploadprogress OOM-corruption and stale-global-state vulnerabilities that can lead to remote code execution. Included is a proof of concept with passive fingerprinting and local Docker lab support. https://packetstorm.news/download/237904...