147464 matches found
EUVD-2026-107348
A vulnerability in Cisco Unified Communications Manager Unified CM and Cisco Unified Communications Manager Session Management Edition Unified CM SME could allow an unauthenticated, remote attacker to conduct access control bypass attacks on an affected device. This vulnerability is due to improp...
CVE-2026-76487 Cisco Unified Communications Manager Improper Access Control Vulnerability
A vulnerability in Cisco Unified Communications Manager Unified CM and Cisco Unified Communications Manager Session Management Edition Unified CM SME could allow an unauthenticated, remote attacker to conduct access control bypass attacks on an affected device. This vulnerability is due to improp...
CVE-2026-113798
The Electron framework is vulnerable to an Origin Validation Error (CWE-346) in versions prior to 42.11.9 , 43.7.6 , 44.5.0 , and 45.0.0-alpha.13 . The root cause is that pointerLock permission requests from certain cross-origin iframes incorrectly cause session.setPermissionRequestHandler() to r...
CVE-2026-113796 Electron: SameSite cookie restrictions are not applied to windows opened from links
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.6, Electron treated pages opened into a new window from links as application-initiated navigations instead of preserving the page...
CVE-2026-113796 Electron: SameSite cookie restrictions are not applied to windows opened from links
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.6, Electron treated pages opened into a new window from links as application-initiated navigations instead of preserving the page...
CVE-2026-113796
The Electron framework (prior to versions 42.11.3 , 43.7.0 , 44.3.0 , and 45.0.0-alpha.6 ) fails to correctly apply SameSite cookie restrictions when opening new windows via links. The framework incorrectly treats these as application-initiated navigations rather than preserving the initiating pa...
Exploit for CVE-2026-109618
php2shell-check Check in about a minute whether a server is a...
php: OOM bailout during request parsing leads to memory corruption and RCE
A flaw was found in PHP's memory limit handling during request parsing. PHP records certain state as ready for use before all required memory allocations complete. If an allocation fails due to memory exhaustion, the incomplete state is not rolled back. Subsequent cleanup operations treat the...
USN-8948-2: PHP vulnerabilities
USN-8948-1 fixed vulnerabilities in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. This provides the corrosponding updates in Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that PHP incorrectly handle...
USN-8948-2 php5, php7.0, php7.2, php7.4 vulnerabilities
USN-8948-1 fixed vulnerabilities in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. This provides the corrosponding updates in Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that PHP incorrectly handle...
[SECURITY] [DSA 6575-1] nginx security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6575-1 [email protected] https://www.debian.org/security/ Jan MojžÃÅ¡ October 21, 2026 https://www.debian.org/security/faq -...
CVE-2026-109618
A flaw was found in PHP's memory limit handling during request parsing. PHP records certain state as ready for use before all required memory allocations complete. If an allocation fails due to memory exhaustion, the incomplete state is not rolled back. Subsequent cleanup operations treat the...
CVE-2026-114470 Cross-Site Request Forgery (CSRF) in hMailServer
Cross-site request forgery in the REST API of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote attacker to make an authenticated user's browser perform a state-changing request. The REST API accepts HTTP Basic authentication and answers a browser with a Basic sign-in box; a brows...
CVE-2026-114470
Progressive Robot hMailServer versions 6.0.0 through 6.3.6 are vulnerable to a Cross-Site Request Forgery (CSRF) in the REST API . The root cause is that while the API protects cookie-based sessions, it does not apply the same protections to HTTP Basic authentication . Because browsers cache Basi...
EUVD-2026-107313
Cross-site request forgery in the REST API of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote attacker to make an authenticated user's browser perform a state-changing request. The REST API accepts HTTP Basic authentication and answers a browser with a Basic sign-in box; a brows...
CVE-2026-114470 Cross-Site Request Forgery (CSRF) in hMailServer
Cross-site request forgery in the REST API of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote attacker to make an authenticated user's browser perform a state-changing request. The REST API accepts HTTP Basic authentication and answers a browser with a Basic sign-in box; a brows...
Two critical RCEs in PHP core
Update 10/22: Added section detailing observations of in the wild exploitation and associated IoCs. Cisco Talos is tracking the disclosure of two unauthenticated remote code execution RCE flaws in PHP core, dubbed "php2shell", triggered by a plain HTTP request and exploitable before any applicati...
Exploit for Server-Side Request Forgery in Plex Media_Server
plex2shell-windows-hunt Threat intel and a read-only Windows/...
CVE-2026-102483 Reachable Assertion in ntpsec
Reachable exit in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to terminate the daemon via an NTS request with excess NTS Cookie Placeholder extension fields...