Rocky Linux 10.2 [CIQ] Security Update: aspnetcore-runtime-9.0 / aspnetcore-runtime-dbg-9.0 / etc Multiple Vulnerabilities (crlsa-2026_86172)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202686172 advisory. dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability CVE-2026-58280 dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Informatio...

CentOS Linux 6 [TuxCare] Security Update: libX11 / libX11-common / libX11-devel Multiple Vulnerabilities (CENTOS6:CLSA-2026:1792609205)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1792609205 advisory. - An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. A malicious server can send a reply in which the firs...

Rocky Linux 8 [CIQ] Security Update: aspnetcore-runtime-8.0 / aspnetcore-runtime-dbg-8.0 / etc Multiple Vulnerabilities (crlsa-2026_86594)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202686594 advisory. dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability CVE-2026-58280 dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information...

PHP 8.5.11 php2shell Vulnerability Scanner

PHP versions 5.4.0 through 8.5.11 contain two remote code execution flaws involving request parsing state. The supplied tool fingerprints targets and can send active validation probes...

CVE-2021-48014: Improper Limitation of a Pathname to a Restricted Directory

FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer designsavesvg operation that allows unauthenticated attackers to write arbitrary files via the filePath parameter. Attackers can send a POST request with directory traversal sequences in filePath and a CONTENT...

PT-2026-121647

Name of the Vulnerable Software and Affected Versions AOS-10 affected versions not specified Description A buffer overflow occurs in the API of AOS-10, which may allow an authenticated adjacent attacker with high privileges to achieve remote code execution. A buffer overflow is a condition where ...

WordPress 7.0.1 REST API Batch-Route Confusion

WordPress versions 6.9.0 through 7.0.1 contain a REST API batch-route confusion issue that, when combined with a related SQL injection vulnerability, may lead to remote code execution...

HPE ArubaOS security vulnerabilities

A security vulnerability exists in HPE ArubaOS. It stems from a buffer overflow issue in the PAPI protocol, which may allow authenticated remote attackers with elevated privileges to execute remote code execution and run arbitrary code as a privileged user on the underlying operating system...

HPE ArubaOS security vulnerabilities

A security vulnerability exists in HPE ArubaOS. It stems from a command injection flaw in the PAPI protocol. An attacker adjacent to the target can send specially crafted packets to achieve unauthenticated remote code execution. Successful exploitation of this vulnerability allows arbitrary code...

PHP 8.5.11 php2shell Patch-Level Verification Tool

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain an out-of-memory handling flaw that can lead to remote code execution. This tool performs host-side patch and configuration checks, or non-destructive external header reconnaissance...

PHP 8.5.11 Session Upload Progress Remote Code Execution

PHP version 8.5.11 contains a use-after-free in session upload progress handling that can lead to remote code execution. This proof of concept targets an isolated local Apache container. https://packetstorm.news/download/236991...

PHP 8.5.11 OOM and Stale State Remote Code Execution

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain OOM-corruption and stale-global-state flaws that can lead to unauthenticated remote code execution. This proof of concept targets affected session upload progress handling. https://packetstorm.news/download/236977...

PHP 8.5.11 OOM Handling Remote Code Execution

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain out-of-memory handling flaws. This proof of concept sends multipart uploads to reach an OOM path and demonstrates a session-lock leak and worker denial of service in a local PHP 8.4.24 lab. https://packetstorm.news/download/237021...

PHP 8.0.30-6 Out-Of-Memory Remote Code Execution

PHP version 8.0.30-6 on EL7 Remi builds is vulnerable to out-of-memory state corruption that can lead to remote code execution. This submission provides a backported mitigation and a Docker proof of concept demonstrating affected session upload progress, local file inclusion, and OOM behavior...

PHP 8.4.26 Session Upload Progress Remote Code Execution

PHP version 8.4.26 contains an issue involving requestparsebody and session upload-progress handling. This proof of concept demonstrates chained unauthenticated remote code execution in a lab application and contrasts the behavior with PHP 8.4.27. https://packetstorm.news/download/236981...

PHP 8.5.11 Remote Code Execution

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain an out-of-memory request parsing vulnerability that can lead to remote code execution. The included proof of concept targets Apache modphp using multipart form input and session upload progress handling...

PHP 8.5.11 Multipart Remote Code Execution

PHP version 8.5.11 contains multipart parsing vulnerabilities that can lead to remote code execution. This package provides a lab proof of concept and validation tooling. https://packetstorm.news/download/236978...

GeoServer 2.25.1 OGC Filter Evaluation Remote Code Execution

GeoServer versions 2.22.5 and earlier, 2.23.5 and earlier, 2.24.0 through 2.24.3, and 2.25.0 through 2.25.1 contain an OGC request-parameter evaluation flaw that allows unauthenticated remote code execution. https://packetstorm.news/download/236996...

PHP 8.5.11 Remote Code Execution

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain an out-of-memory request-state corruption flaw. This proof of concept demonstrates a build-specific unauthenticated command-execution chain against PHP version 8.4.7 Apache/modphp using a related stale-global-state flaw...

PHP 8.4.26 Remote Code Execution

PHP version 8.4.26 contains upload-progress and stale-state vulnerabilities that can allow unauthenticated remote code execution. This proof of concept targets Apache modphp prefork deployments. https://packetstorm.news/download/237017...