PHP 8.5.11 session.upload_progress Remote Code Execution

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain session.uploadprogress state-corruption vulnerabilities that may permit unauthenticated remote code execution. This proof of concept exercises upload-progress and out-of-memory failure paths, with optional LFI-assisted command...

PHP 8.5.11 OOM and Stale State Remote Code Execution

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain OOM-corruption and stale-global-state flaws that can lead to unauthenticated remote code execution. This proof of concept targets affected session upload progress handling. https://packetstorm.news/download/236977...

PHP 8.4.26 Session Upload Progress Remote Code Execution

PHP version 8.4.26 contains an issue involving requestparsebody and session upload-progress handling. This proof of concept demonstrates chained unauthenticated remote code execution in a lab application and contrasts the behavior with PHP 8.4.27. https://packetstorm.news/download/236981...

PHP 8.5.11 Remote Code Execution

PHP version 8.5.11 and prior affected versions contain use-after-free vulnerabilities that can lead to unauthenticated remote code execution. This proof of concept targets PHP 8.4.26 with Apache modphp prefork. https://packetstorm.news/download/237019...

GeoServer 2.25.1 OGC Filter Evaluation Remote Code Execution

GeoServer versions 2.22.5 and earlier, 2.23.5 and earlier, 2.24.0 through 2.24.3, and 2.25.0 through 2.25.1 contain an OGC request-parameter evaluation flaw that allows unauthenticated remote code execution. https://packetstorm.news/download/236996...

ROS-20261022-73-0060

The vulnerability in Go-Git is related to the lack of mechanisms for encoding or shielding output data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2026-121737

Name of the Vulnerable Software and Affected Versions NoMachine nxwebrunner affected versions not specified Description A heap-based buffer overflow exists in the web service that listens on TCP port 4443 by default. The issue occurs because the service fails to properly validate the length of...

PHP 8.4.26 Remote Code Execution

PHP version 8.4.26 contains a memory-corruption issue triggered by request parsing under memory exhaustion. The supplied proof of concept uses crafted multipart requests to leak addresses and execute a command against a vulnerable Apache/modphp target. https://packetstorm.news/download/237008...

PT-2026-121596

Name of the Vulnerable Software and Affected Versions AOS-8 affected versions not specified Description A command injection issue exists in the PAPI protocol, which is used for access point management. An unauthenticated attacker can achieve remote code execution by sending specially crafted...

CVE-2021-48014: Improper Limitation of a Pathname to a Restricted Directory

FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer designsavesvg operation that allows unauthenticated attackers to write arbitrary files via the filePath parameter. Attackers can send a POST request with directory traversal sequences in filePath and a CONTENT...

CVE-2026-51954

An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitrary code via a crafted OAuth authorization URL with an arbitrary redirecturi...

PHP 8.5.11 Remote Code Execution Exposure Checker

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain out-of-memory corruption and stale global-state vulnerabilities that may allow unauthenticated remote code execution. The tool checks local configuration or triages an authorized remote host...

EUVD-2026-108222

An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitrary code via a crafted OAuth authorization URL with an arbitrary redirecturi...

CVE-2026-51954

An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitrary code via a crafted OAuth authorization URL with an arbitrary redirecturi...

Rocky Linux 10.2 [CIQ] Security Update: aspnetcore-runtime-9.0 / aspnetcore-runtime-dbg-9.0 / etc Multiple Vulnerabilities (crlsa-2026_86172)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202686172 advisory. dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability CVE-2026-58280 dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Informatio...

Rocky Linux 9 [CIQ] Security Update: aspnetcore-runtime-10.0 / aspnetcore-runtime-dbg-10.0 / etc Multiple Vulnerabilities (crlsa-2026_86193)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202686193 advisory. dotnet: dotnet10.0: ASP.NET Core Remote Code Execution Vulnerability CVE-2026-102870 dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service...

Rocky Linux 8 [CIQ] Security Update: aspnetcore-runtime-9.0 / aspnetcore-runtime-dbg-9.0 / etc Multiple Vulnerabilities (crlsa-2026_86170)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202686170 advisory. dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability CVE-2026-58280 dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information...

HPE ArubaOS security vulnerabilities

A security vulnerability exists in HPE ArubaOS. It stems from a buffer overflow flaw in affected interfaces, enabling unauthorized remote code execution. Successful exploitation allows attackers to execute arbitrary code with privileged user privileges on the underlying operating system, resultin...

HPE ArubaOS security vulnerabilities

HPE ArubaOS 8 has a security vulnerability stemming from the sending of specially crafted PAPI packets. This can lead to unauthenticated remote code execution, potentially allowing attackers to execute arbitrary code as a privileged user on the underlying operating system...

HPE ArubaOS security vulnerabilities

HPE ArubaOS 8 contains a buffer overflow vulnerability. This vulnerability stems from a buffer overflow in affected interfaces and may lead to unauthenticated remote code execution. Attackers can execute arbitrary code as a privileged user on the underlying operating system...