Exploit for CVE-2026-109618

php2shell-detection Detection signatures and interim mitigati...

CVE-2026-113263

A flaw was found in chromium-browser. This flaw allows a remote attacker to achieve arbitrary code execution outside the browser sandbox by enticing a user to view a specially crafted HTML page. The vulnerability stems from a use-after-free memory error in the Core component, which occurs when...

curl: Heap-use-after-free in libcurl's multi event machinery (curl_multi_remove_handle() from a socket callback nested under a notify callback)

Summary: The multi interface in libcurl 8.23.0 and current master has a reproducible use-after-free. Inside a CURLMOPTNOTIFYFUNCTION callback, calling curleasypause on a second transfer that is still in flight re-enters libcurl's event handling and invokes the socket callback, where a...

Exploit for CVE-2026-109618

⚡ php2shell: Pre-Auth Remote Code Execution in PHP Core I...

CVE-2026-111804

The Apache Traffic Server experimental wasm plugin is vulnerable to a use-after-free flaw located in its transaction-close handler . Additionally, the plugin forwards unvalidated guest-supplied metric IDs to the internal stats API. This issue impacts versions 10.0.0 through 10.1.4 and 10.2.0 . Af...

CVE-2026-111804

Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to...

CVE-2026-111804 Apache Traffic Server: wasm plugin has a use-after-free and forwards unvalidated guest metric IDs

Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to...

EUVD-2026-107490

Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to...

CVE-2026-111804 Apache Traffic Server: wasm plugin has a use-after-free and forwards unvalidated guest metric IDs

Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to...

CVE-2026-78118 Race condition on kernel wait queues: unlocked z_waitq_head() read in the timer expiration handler can yield a stale or sentinel thread pointer on SMP

The kernel helper zwaitqhead kernel/include/waitq.h reads the head of a thread wait queue, but on SMP systems it was called from several places without holding the scheduler spinlock schedspinlock that serializes wait-queue mutation. The consequential call site is ztimerexpirationhandler in...

CVE-2026-78118

The Zephyr RTOS kernel contains a race condition in the z_waitq_head() helper function (kernel/include/wait_q.h). On SMP systems , this helper was called from several locations—notably z_timer_expiration_handler() in kernel/timer.c—without holding the _sched_spinlock, which is required to seriali...

EUVD-2026-107485

The kernel helper zwaitqhead kernel/include/waitq.h reads the head of a thread wait queue, but on SMP systems it was called from several places without holding the scheduler spinlock schedspinlock that serializes wait-queue mutation. The consequential call site is ztimerexpirationhandler in...

CVE-2026-78118 Race condition on kernel wait queues: unlocked z_waitq_head() read in the timer expiration handler can yield a stale or sentinel thread pointer on SMP

The kernel helper zwaitqhead kernel/include/waitq.h reads the head of a thread wait queue, but on SMP systems it was called from several places without holding the scheduler spinlock schedspinlock that serializes wait-queue mutation. The consequential call site is ztimerexpirationhandler in...

CVE-2026-78118 Race condition on kernel wait queues: unlocked z_waitq_head() read in the timer expiration handler can yield a stale or sentinel thread pointer on SMP

The kernel helper zwaitqhead kernel/include/waitq.h reads the head of a thread wait queue, but on SMP systems it was called from several places without holding the scheduler spinlock schedspinlock that serializes wait-queue mutation. The consequential call site is ztimerexpirationhandler in...

Adm-zip: Duplicate ZIP Entry Names: GetEntry() And ExtractAllTo() Resolve To Different Content

Summary A ZIP file can contain two entries with the identical name. adm-zip keeps both in its internal entry list, but its name-lookup table only retains the last one written. "getEntryname" and "extractAllTo" walk these two different internal structures, so they can each resolve a duplicate name...

CVE-2026-113222

A flaw was found in Chromium's V8 engine. A remote attacker could exploit this use-after-free vulnerability by convincing a user to visit a specially crafted HTML page. Successful exploitation could allow the attacker to execute arbitrary code outside the browser sandbox...

CVE-2026-113189

A flaw was found in chromium-browser. This flaw allows a remote attacker to achieve arbitrary code execution outside the browser sandbox by enticing a user to visit a specially crafted HTML page. The issue stems from a use-after-free memory management vulnerability in the Core component, which ca...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

CVE-2026-109618 / CVE-2026-109619: PHP Use-After-Free via zen...

Use of Less Trusted Source

Overview Affected versions of this package are vulnerable to Use of Less Trusted Source via the ClientIPFromXFF process. An attacker can manipulate the client IP address returned by the middleware by appending a trusted-looking proxy address to the X-Forwarded-For header when connecting directly ...

Use of Less Trusted Source

Overview Affected versions of this package are vulnerable to Use of Less Trusted Source via the ClientIPFromXFF process. An attacker can manipulate the client IP address returned by the middleware by appending a trusted-looking proxy address to the X-Forwarded-For header when connecting directly ...