php2shell-poc

CVE-2026-109618 / CVE-2026-109619 — PHP upload-progress RCE P...

CVE-2026-111812

Apache Traffic Server's originserverauth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are...

CVE-2026-111809

Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16,...

CVE-2026-114139

The Sentry-Javascript SDK for JavaScript contains a middleware bypass vulnerability in its webpack integration for @sentry/nextjs . Versions 9.36.0 through 9.47.2, 10.75.2, and 11.0.0-rc.1 are affected. The root cause is that the integration skips application middleware for all paths under a conf...

CVE-2026-114139 Sentry-Javascript: Middleware Bypass when using Tunnel route

Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjs skips application middleware for every request path under a configured tunnelRoute, while the tunnel rewrite serves only the exact tunnel pat...

Exploit for CVE-2026-109618

php-oom-corruption-lab Research lab, verification tooling and...

php: OOM bailout during request parsing leads to memory corruption and RCE

A flaw was found in PHP's memory limit handling during request parsing. PHP records certain state as ready for use before all required memory allocations complete. If an allocation fails due to memory exhaustion, the incomplete state is not rolled back. Subsequent cleanup operations treat the...

php: OOM bailout during request parsing leads to memory corruption and RCE

A flaw was found in PHP's memory limit handling during request parsing. PHP records certain state as ready for use before all required memory allocations complete. If an allocation fails due to memory exhaustion, the incomplete state is not rolled back. Subsequent cleanup operations treat the...

CVE-2026-114457

A flaw was found in modqos. An unauthenticated remote attacker could cause a Denial of Service DoS by sending a specially crafted JSON request when JSON body filtering is enabled. Due to improper string termination during the processing of percent-encoded input, the module reads past allocated...

CVE-2026-114460

A flaw was found in modqos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which truncates the query string during security evaluation while leaving the actual request unchanged. An unauthenticated remote attacker could exploit this...

php: OOM bailout during request parsing leads to memory corruption and RCE

A flaw was found in PHP's memory limit handling during request parsing. PHP records certain state as ready for use before all required memory allocations complete. If an allocation fails due to memory exhaustion, the incomplete state is not rolled back. Subsequent cleanup operations treat the...

CVE-2025-55972-Remote-Unauthenticated-Denial-of-Service-DoS-in-TCL-Smart-TV-UPnP-DLNA-AVTransport

CVE-2025-55972-Remote-Unauthenticated-Denial-of-Service-DoS-in-TCL-Smart-TV-UPnP-DLNA-AVTransport A TCL Smart TV running a vulnerable UPnP/DLNA MediaRenderer implementation is affected by a remote, unauthenticated Denial of Service DoS. Vendor: TCL Technology Group Corporation Product: TCL Smart ...

php: Fix of 2 CVEs

CVE-2026-109618: avoid heap state corruption via bailout on out-of-memory - CVE-2026-109619: reset per-request globals that could be reused after a bailout during request startup...

portabilis-ieducar-user-type-privilege-escalation

Portabilis i-Educar = 2.1.13 Privilege Escalation Through Arbitrary Request to User Type Change Endpoint Proof of concept for exploitation of the vulnerability described in CVE-2025-11554, which concerns the possibility of a privilege escalation during arbitrary requests to user types endpoints i...

Atmail-exploit-toolchain

AtMail Email Server Appliance 6.4 - Exploit toolchain XSS CSRF RCE PacketStorm WLB-2020080010 Disclaimer: this exploit toolchain was inspired by EDB-ID 20009. Goal The goal of this exploit toolchain is to replace EDB-ID 20009. Pros of this toolchain over EDB-ID 20009 exploit: Simple to use Reusab...

CVE-2026-30498

CVE-2026-30498 – CSRF Vulnerability AdminPanel 4.0 Overview CVE ID: CVE-2026-30498 Reserved by MITRE Discoverer: Mehdi Ben Hamou A Cross-Site Request Forgery CSRF vulnerability exists in the delete.php endpoint of AdminPanel 4.0. This vulnerability allows an attacker to trigger sensitive actions...

CVE-2026-114374

The leomoon-studios wiki-go software, versions up to 1.9.1 , is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability. The flaw exists within an unknown function in the internal/handlers/metadata_api.go file, specifically affecting the fetch-metadata Endpoint component. An attacker can...

CVE-2026-112381

Apache Traffic Server versions 9.2.15 , 10.1.4 , and 10.2.0 are vulnerable to a null pointer dereference in the net_write_io function. The flaw is a timing-dependent race condition triggered when a client POST request is torn down via a half-close while a chunked origin response is being reparsed...

EUVD-2026-107536

Apache Traffic Server's originserverauth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are...

CVE-2026-111812

Apache Traffic Server's originserverauth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are...