CVE-2025-60490

A heap use-after-free in the gffilterpidsendeventdownstream function /filtercore/filterpid.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

UBUNTU-CVE-2025-60491

A heap use-after-free in the dasherflushsegment function /filters/dasher.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

CVE-2025-60491

A heap use-after-free in the dasherflushsegment function /filters/dasher.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

UBUNTU-CVE-2025-60478

A use-after-free in the gffilterpacketdestroy function /filtercore/filterpck.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MPEG-2 file...

CVE-2025-60478

A use-after-free in the gffilterpacketdestroy function /filtercore/filterpck.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MPEG-2 file...

CVE-2026-114474

Progressive Robot hMailServer versions 6.0.0 through 6.3.6 are vulnerable to a Use of Less Trusted Source (CWE-348) issue during external-account downloads. When the server downloads messages from external POP3 or IMAP accounts, it fails to generate a proper SMTP envelope, instead using the addre...

CVE-2026-114474 Use of Less Trusted Source in hMailServer

Use of a less trusted source for the envelope sender in the external-account download of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write in the name of a domain the server hosts sent on by the server with an envelope sender at tha...

Exploit for CVE-2026-109618

php2shell — CVE-2026-109618 / CVE-2026-109619 PoC Heap Us...

CVE-2026-98788

A flaw was found in the Linux kernel's futex fast userspace mutex subsystem. When resizing a private hash table, improper synchronization allows the old table memory to be released while another thread is still referencing it. A local attacker could exploit this race condition to trigger a...

php2shell-exploit

CVE-2026-109618 / CVE-2026-109619 — PHP session.uploadprogre...

CVE-2026-98625

A flaw was found in the Linux kernel's netfilter subsystem. A timing conflict, or race condition, in the flowtable offload component allows flow data to be prematurely released from memory while still being processed by a cleanup worker. A local attacker could exploit this use-after-free...

Exploit for CVE-2026-109618

CVE-2026-109618 Affected-Version Checker Non-destructive chec...

Exploit for CVE-2026-109619

CVE-2026-109619 Affected-Version Checker Non-destructive chec...

Exploit for CVE-2026-109618

php2shell - PoC for CVE-2026-109618 / CVE-2026-109619 Proof-o...

Exploit for CVE-2026-109618

php2shell-poc PHP Serializable varhash use-after-free → RC...

Exploit for CVE-2026-109618

PHP: PHP2Shell CVE-2026-109618 and CVE-2026-109619 PHP CVE-20...

Exploit for CVE-2026-109619

CVE-2026-109619 Cross-request use-after-free in PHP's se...

OpenEXR: OpenEXR: Out-of-bounds write vulnerability via crafted EXR files

A flaw was found in OpenEXR. A remote attacker could exploit this vulnerability by providing a specially crafted EXR image file with a nonzero dataWindow.min. This could cause the TypedFlatImageChannel::row function to return an invalid memory pointer, leading to out-of-bounds or use-after-free...

Exploit for CVE-2026-109618

php2shell - PoC for CVE-2026-109618 / CVE-2026-109619 Proof-o...

UBUNTU-CVE-2026-109619

request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it...