Ivanti Connect Secure 25.1.2.x Authentication Bypass Triage

Ivanti Connect Secure versions 25.1.0.0 through 25.1.1.1, 25.1.2.x before 25.1.3.0, and 22.8R2 through 22.8R2.4 contain an authentication bypass by spoofing. This offline checker triages operator-supplied version data without testing exploitability. https://packetstorm.news/download/237521...

PHP 8.5.11 out of Memory Remote Code Execution

PHP versions prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain an out-of-memory handling flaw that can leave request memory in an invalid state. This proof of concept compares affected and fixed builds. https://packetstorm.news/download/237484...

Google Brotli 1.2.0 Out-Of-Bounds Write

This proof of concept demonstrates an out-of-bounds write in Google Brotli version 1.2.0 caused by malformed block-switch handling. https://packetstorm.news/download/237483...

Laravel Framework 13.28.0 TokenGuard Authentication Bypass

Laravel Framework versions before 12.68.0 and versions 13.0.0 through 13.28.0 contain a TokenGuard authentication bypass when non-string API credentials are mishandled. The included proof of concept performs bounded local and remote checks. https://packetstorm.news/download/237478...

Oracle Java 17 ECDSA Signature Verification Bypass

Oracle Java versions 11 through 17 contain an ECDSA signature verification flaw. The supplied Python proof of concept models acceptance of an invalid zero-valued signature, permitting signature-verification bypass. https://packetstorm.news/download/237525...

Node.js 22.x/24.x/26.x Brotli Decoder Out-Of-Bounds Write

Node.js versions prior to 22.23.4, 24.22.1, and 26.12.1 contain an out-of-bounds write in the Brotli decoder. The supplied proof of concept provides patch detection, denial-of-service tests, resource amplification, and a constrained lab RCE chain. https://packetstorm.news/download/237526...

Next.js 16.4.0 use cache Typed Array Remote Code Execution

Next.js version 16.4.0 use cache functions returning multiple typed arrays contain a React Flight framing flaw that can permit unauthenticated remote code execution. The proof of concept demonstrates affected and fixed versions. https://packetstorm.news/download/237482...

HONOR Win2 MagicOS 11.0.0.115 Local Privilege Escalation

HONOR Win2 MagicOS version 11.0.0.115SP7C00E115R101P3 with the specified Android 17 kernel contains a POSIX CPU timer use-after-free. The supplied proof of concept obtains temporary root access and loads BakaSU. https://packetstorm.news/download/237481...

Node.js 26.5.0 HTTPS Agent Session Reuse Verification Bypass

Node.js versions before 22.23.2, 24.18.1, and 26.5.1 contain an HTTPS Agent TLS session reuse flaw that can skip hostname verification across identity policies. This offline checker assesses supplied version evidence and does not test exploitability. https://packetstorm.news/download/237495...

SonicWall SMA1000 12.5.0-02952 Check

SonicWall SMA1000 versions through 12.4.3-03526 and 12.5.0-02952 contain an authenticated remote code execution vulnerability. This offline tool assesses operator-supplied version evidence without contacting targets or testing exploitability. https://packetstorm.news/download/237489...

SonicWall SMA1000 12.5.0-02952 AMC Cross Site Scripting

SonicWall SMA1000 versions through 12.4.3-03526 and 12.5.0-02952 contain a post-authentication AMC stored cross site scripting vulnerability. This offline checker assesses supplied version evidence without contacting a target or testing exploitability. https://packetstorm.news/download/237487...

PHP 8.5.11 Session Upload Progress Trigger

PHP version 8.5.11 session.uploadprogress proof of concept triggers request-startup memory exhaustion with multipart form data, causing a PHP-FPM worker exit and nginx 502 response in the supplied local lab. https://packetstorm.news/download/237480...

NetScaler ADC and Gateway 14.1 HTTP URL Expression Policy Bypass

NetScaler ADC and Gateway versions before specified fixed builds contain an HTTP URL expression policy bypass. This offline Python tool evaluates operator-reported build and configuration evidence for CVE-2026-88774 without contacting appliances or testing exploitability...

Citrix NetScaler ADC and Gateway 14.1 Before 14.1-73.37 Memory Overflow Checker

Citrix NetScaler ADC and Gateway versions before the vendor-fixed builds contain a memory overflow vulnerability under specified non-HTTP L7 deployment conditions. This offline Python tool evaluates operator-reported version and configuration evidence without contacting appliances or testing...

LiteLLM 1.104.0-rc.1 Forged Admin Session

LiteLLM versions reuse the at-rest encryption context for session tokens. This proof of concept obtains an encrypted forged admin token through key metadata, replays it for proxy-admin access, and demonstrates code execution through an MCP stdio server. https://packetstorm.news/download/237524...

Traefik 3.7.10 Digest Authentication Bypass

Traefik versions before 2.11.55 and 3.0.0 through 3.7.10 contain an authentication bypass in the digestAuth middleware that accepts forged digest responses for unknown users. https://packetstorm.news/download/237471...

Krayin CRM 2.2.x Authenticated Shell Upload

Krayin CRM version 2.2.x contains an authenticated arbitrary file upload vulnerability in its TinyMCE upload endpoint that may allow server-side PHP code execution. This proof of concept authenticates to the application and uploads a supplied file. https://packetstorm.news/download/237475...

n8n 2.36.1 Git Node Remote Code Execution

n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain a remote code execution vulnerability in the Git node. A repository-local Git content-filter configuration can execute a command during a Git operation. https://packetstorm.news/download/237473...

SPIP 4.4.16 SQL Injection / SSRF

SPIP version 4.4.16 and earlier contain an unauthenticated blind SQL injection in the sitemap endpoint and an authenticated SSRF issue caused by unvalidated HTTP redirect targets. Proof of concept material is included for both vulnerabilities. https://packetstorm.news/download/237466...

PHP 8.4.27 Session Upload Progress Remote Code Execution

PHP version 8.4.27 and earlier contain a session upload-progress serialization handler mismatch that can allow pre-auth object injection and remote code execution when application code changes the session serialization handler before sessionstart. https://packetstorm.news/download/237461...

Joomla Novarain Framework 6.0.37 Arbitrary File Upload

Joomla Tassos/Novarain Framework versions 4.10.14 through 6.0.37 contain an improper access control issue in the comajax endpoint. The proof of concept uses the nrinlinefileupload gadget to upload files. https://packetstorm.news/download/237459...

Pillow 12.3.0 Ghostscript Argument Injection

Pillow versions 2.6.0 through 12.3.0 contain an argument injection issue in Ghostscript EPS rendering. This proof of concept demonstrates the issue using a harmless Ghostscript help option. https://packetstorm.news/download/237469...

Microsoft Windows 10 20H2 HTTP.sys Use-After-Free

Microsoft Windows 10 versions 2004 and 20H2 and Windows Server versions 2004 and 20H2 contain an HTTP.sys use-after-free vulnerability. The supplied proof of concept sends a malformed Accept-Encoding header to trigger a crash on an unpatched listener. https://packetstorm.news/download/237474...

n8n 2.38.1 Expression Sandbox Escape

n8n versions prior to 1.123.76, versions 2.0.0 through 2.37.6, and versions 2.38.0 through 2.38.1 contain an expression sandbox escape that can lead to code execution by an authenticated workflow editor. https://packetstorm.news/download/237472...

Synology DiskStation Manager 7.2.2 Remote Code Execution

Synology DiskStation Manager versions before 7.2.2-72806-1 contain an improper encoding or escaping flaw in the system plugin daemon that allows remote attackers to execute arbitrary code. This proof of concept demonstrates environment-variable injection through the login flow...

Microsoft Windows Backup Service Privilege Escalation

Microsoft Windows Backup Service contains a privilege escalation vulnerability. This proof of concept abuses a scheduled-backup operation and Windows Installer rollback-file race condition. https://packetstorm.news/download/237457...

Ruby-SAML 1.16.0 SAML Authentication Bypass

Ruby-SAML versions through 1.12.2 and versions 1.13.0 through 1.16.0 improperly verify SAML response signatures. The included proof of concept forges SAML assertion contents and submits them to a vulnerable GitLab SAML callback. https://packetstorm.news/download/237455...

LibreNMS 26.7.0 Authentication Bypass

LibreNMS versions through 26.7.0 contain an authentication bypass via API token type confusion. This proof of concept retrieves device data and uses exposed SNMP credentials for network reconnaissance. https://packetstorm.news/download/237462...

Traefik 3.7.12 Rootless HTTP Request Target Authorization Bypass

Traefik versions through 2.11.56 and 3.7.12 route rootless opaque HTTP request targets as / while forwarding them verbatim, allowing path-scoped authorization bypass and access log evasion against susceptible backends. https://packetstorm.news/download/237470...

PHP 8.5.11 Remote Code Execution

PHP versions 5.4.0 through 8.5.11 contain pre-authentication remote code execution vulnerabilities involving out-of-memory handling and stale request state. https://packetstorm.news/download/237464...

libexpat 2.6.2 XML_ParseBuffer Negative Length

libexpat versions prior to 2.6.3 do not reject negative lengths passed to XMLParseBuffer. This proof of concept compiles a small harness and demonstrates the condition against version 2.6.2. https://packetstorm.news/download/237528...

PHP 8.5.11 Remote Code Execution

PHP versions through 8.5.11 contain out-of-memory handling and use-after-free flaws that can allow unauthenticated remote code execution. This proof of concept demonstrates an HTTP-only exploit chain against PHP version 8.4.26 running under Apache modphp. https://packetstorm.news/download/237463...

MLflow 3.14.x Webhook Server-Side Request Forgery

MLflow versions 3.3.0 through 3.14.x contain an unauthenticated server-side request forgery vulnerability in the webhook test endpoint. Redirects or DNS rebinding can bypass URL validation and expose responses from internal services. https://packetstorm.news/download/237458...

openapi-typescript-codegen 0.31.0 Code Injection

openapi-typescript-codegen version 0.31.0 contains a code injection vulnerability via unescaped OpenAPI specification values rendered into generated TypeScript clients. The proof of concept demonstrates benign import-time execution. https://packetstorm.news/download/237427...

needrestart 3.7 Local Privilege Escalation

needrestart before version 3.8 allows local attackers to execute arbitrary code as root through an attacker-controlled PYTHONPATH environment variable. This proof of concept causes a root needrestart process to create a set-user-ID copy of bash. https://packetstorm.news/download/237426...

Apache Karaf Cellar 4.4.8 Remote Code Execution

Apache Karaf Cellar version 4.4.8 contains an unauthenticated cluster-join vulnerability that allows a network-adjacent attacker to publish a bundle event and execute code on cluster nodes. !/usr/bin/env bash Apache Karaf Cellar 4.4.8 Remote Code Execution Vendor: The Apache Software Foundation...

Apache Tomcat 11.0.25 WebSocket Security Constraint Bypass

Apache Tomcat versions through 11.0.25, 10.1.59, and 9.0.121 contain a WebSocket endpoint template-path security constraint bypass. This proof of concept demonstrates anonymous access using an alternate endpoint path. https://packetstorm.news/download/237421...

Node.js 26.12.0 Brotli Decoder Remote Code Execution

Node.js versions prior to 22.23.4, 24.22.1, and 26.12.1 contain a Brotli decoder out-of-bounds write that may lead to remote code execution when processing crafted compressed input. Included proof of concept demonstrates the issue in local Docker labs. https://packetstorm.news/download/237425...

PHP Session Upload Progress Remote Code Execution

PHP contains a session upload-progress deserialization vulnerability that can result in remote command execution when an application switches the session serializer at runtime. The proof of concept provides a local intentionally vulnerable lab. https://packetstorm.news/download/237419...

PHP 8.4.26 Pre-Authentication Remote Code Execution

PHP version 8.4.26 contains out-of-memory handling and use-after-free flaws in request processing. The supplied proof of concept uses crafted HTTP multipart requests to disclose process memory and execute a short command without authentication. https://packetstorm.news/download/237415...

GitLab CE/EE 19.5.0 Regular Expression Integer Overflow

GitLab CE/EE versions before 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, and 19.5.1 contain a regular expression compiler integer overflow that may allow unauthenticated arbitrary code execution. This proof of concept generates crafted Org-mode content and triggers the affected render path...

YOOtheme Pro 5.0.52 Unauthenticated Remote Code Execution

YOOtheme Pro versions 5.0.0 through 5.0.52 contain an unauthenticated remote code execution vulnerability in the public image transformation handler. The supplied proof of concept reuses a signed image URL to inject image operations and write an executable polyglot outside the cache directory...

Apache RocketMQ Client C++ 2.2.0 Out-of-Bounds Read

Apache RocketMQ Client C++ version 2.2.0 contains a remote out-of-bounds read in the RemotingCommand decoder that can allow a malicious broker or nameserver to crash a client. !/usr/bin/env bash Apache RocketMQ Client C++ 2.2.0 RemotingCommand::Decode Out-of-Bounds Read Vendor: The Apache Softwar...

Laravel Framework 12.67.0 TokenGuard Authentication Bypass

Laravel Framework version 12.67.0 contains an authentication bypass in TokenGuard when used with an Eloquent user provider and MySQL or MariaDB. The supplied proof of concept demonstrates authentication with a crafted non-string API token. https://packetstorm.news/download/237410...

PHP 8.4.26 Stale Session Global State Remote Code Execution

PHP version 8.4.26 contains a stale session global-state use-after-free vulnerability that can lead to remote code execution. This proof of concept demonstrates the issue through session upload progress handling. https://packetstorm.news/download/237408...

PHP Session Upload Progress Remote Code Execution

PHP session upload progress can permit attacker-controlled object deserialization when an application uses phpbinary or phpserialize and switches to the php serializer before sessionstart. Included proof of concept demonstrates the serializer-switch condition and a session-file LFI lab...

Gitea 1.27.0 Arbitrary File Read

Gitea version 1.27.0 and prior affected versions contain an arbitrary file read through Org-mode +INCLUDE directives submitted to a public repository markup endpoint. The proof of concept retrieves target files and attempts a chain to command execution. https://packetstorm.news/download/237363...

PHP Session Serialize Handler Confusion

PHP contains a session upload progress serialization handler confusion condition when an application changes its configured handler to php at runtime before sessionstart while upload progress remains enabled. The proof of concept demonstrates attacker-controlled unserialization in a local lab...

Cisco Catalyst SD-WAN Manager 26.2 API Authentication Bypass

Cisco Catalyst SD-WAN Manager versions before the fixed releases contain an API authentication bypass caused by improper URI encoding handling. The included proof of concept details a crafted request that can obtain an administrative API session. https://packetstorm.news/download/237420...

Laravel Framework 13.28.0 TokenGuard Authentication Bypass

Laravel Framework versions before 13.29.0 contain an authentication bypass in TokenGuard on MySQL or MariaDB. This proof of concept submits a non-string API token value that can authenticate as an unintended existing user. https://packetstorm.news/download/237418...