Joomla Content Editor 2.9.99.4 Unauthenticated Remote Code Execution

Joomla Content Editor versions through 2.9.99.4 contain an improper access control vulnerability in profile import functionality that allows unauthenticated attackers to upload PHP files and execute code. https://packetstorm.news/download/238566...

Gitea 28.1.0 Draft Release Attachment Metadata Disclosure

Gitea versions 1.22.0 through 28.1.0 contain an information disclosure where creating a draft release can return metadata for unlinked attachments from private repositories. https://packetstorm.news/download/238569...

free5gc v4.2.3+ Root CA Private Key Exposure

free5gc versions v1.0.0 through v4.2.3+ contain a publicly committed Root CA private key that can be used to forge trusted network function certificates in deployments using its shipped TLS trust anchor. A proof of concept is provided. https://packetstorm.news/download/238561...

GLPI 11.0.5 Server-Side Template Injection

GLPI versions 11.0.0 through 11.0.5 contain a server-side template injection issue in Forms dropdown values that can let an authenticated administrator execute code when the form editor renders the value. The included proof of concept documents the vulnerable render flow and the 11.0.6 fix...

GeoServer 2.25.1 Remote Command Execution

GeoServer versions before 2.22.6, 2.23.6, 2.24.4, and 2.25.2 contain an unauthenticated remote code execution vulnerability in OGC request property-name expression evaluation. This proof of concept provides interactive command execution through WFS GetPropertyValue...

free5GC BSF 1754bde Missing Authentication

free5GC BSF version 1754bde and earlier exposes its SBI management endpoints without authentication. The proof of concept demonstrates unauthenticated creation, retrieval, modification, and deletion of PCF bindings. https://packetstorm.news/download/238558...

Mozilla Firefox ESR 17 Use-After-Free

Mozilla Firefox ESR version 17 contains a document-loading use-after-free vulnerability. This proof of concept performs heap grooming, corrupts ArrayBuffer metadata, and executes a staged payload on the historical target. https://packetstorm.news/download/238563...

Apple LinkPresentation HEIC Out-Of-Bounds Write

Apple LinkPresentation contains an out-of-bounds write when processing a maliciously crafted image. The proof of concept generates mismatched HEIC frames and fetches the image through Open Graph link metadata. https://packetstorm.news/download/238556...

EPSON Printer Controller Installer 1.0.0 Local Privilege Escalation

EPSON Printer Controller Installer version 1.0.0 contains improper authorization handling in its privileged helper, allowing local low-privileged users to invoke privileged XPC operations and execute commands as root. The included proof of concept documents the issue...

WordPress Content Egg Cross Site Scripting

WordPress Content Egg versions before 11.9.0 contain a stored cross site scripting vulnerability that lets Contributor-level users enqueue unescaped content through an administrator-owned import preset. https://packetstorm.news/download/238560...

Traggo Server 0.8.3 GraphQL Alias Overloading Denial of Service

Traggo server version 0.8.3 contains an unauthenticated denial of service condition in its GraphQL endpoint due to alias overloading and missing request complexity and body-size limits. A proof of concept is provided. https://packetstorm.news/download/238544...

Spina CMS 2.21.0 Authenticated Cross Site Scripting

Spina CMS version 2.21.0 contains an authenticated stored cross site scripting issue in rich text embeds. A staff user can store a javascript: URL that is rendered on the public site. https://packetstorm.news/download/238546...

astro-notion-blog 0.13.0 Path Traversal / Remote Code Execution

astro-notion-blog version 0.13.0 allows Notion database editors to supply an encoded FeaturedImage filename that escapes the image directory during site builds, overwrites an Astro page, and enables code execution as the build user. https://packetstorm.news/download/238545...

Google Chrome 70.0.3538.0 V8 Type Confusion

A proof of concept for a V8 TurboFan Object.create type confusion in Google Chrome version 70.0.3538.0 that achieves arbitrary memory read/write and executes calculator shellcode through a WebAssembly RWX page. https://packetstorm.news/download/238565...

Apple LinkPresentation Malformed HEIC Memory Corruption

Apple LinkPresentation contains an out-of-bounds write when processing a maliciously crafted image. The supplied proof of concept delivers a malformed HEIC image through Open Graph link-preview metadata to reproduce the issue. https://packetstorm.news/download/238559...

Redmi K90 HyperOS 4.0.5.0 Temporary Root Research

Redmi K90 HyperOS versions 4.0.0.27, 4.0.0.34, and 4.0.5.0 are documented in experimental temporary-root compatibility research related to CVE-2026-64560. The material contains testing criteria and firmware observations but no exploit code or executable payloads...

SUSE Rancher 2.15.1 Cross Site Scripting

SUSE Rancher versions 2.11 before 2.11.18, 2.12 before 2.12.14, 2.13 before 2.13.10, 2.14 before 2.14.6, and 2.15 before 2.15.2 contain an unauthenticated public UI settings update flaw that can lead to stored cross site scripting. The proof of concept submits an alert payload...

Apple LinkPresentation Out-Of-Bounds Write

Apple LinkPresentation contains an out-of-bounds write vulnerability. Processing a maliciously crafted HEIC image may result in memory corruption. https://packetstorm.news/download/238532...

EditorConfig Core C 0.12.10 Stack Buffer Overflow

EditorConfig Core C versions through 0.12.10 contain a stack buffer overflow in ecglob. A proof of concept uses a crafted directory structure and .editorconfig glob pattern to crash an application using libeditorconfig. https://packetstorm.news/download/238549...

Apple AVEVideoEncoder iOS 26.0 Denial of Service

Apple AVEVideoEncoder in iOS version 26.0 contains an out-of-bounds write that may cause unexpected system termination. The supplied Swift proof of concept submits a 32768 x 16384 BGRA frame to a VideoToolbox H.264 compression session to reproduce the crash. https://packetstorm.news/download/2385...

Vivo S60 16.0.11.15.W10 POSIX Timer Local Privilege Escalation

Vivo S60 version 16.0.11.15.W10 with kernel 6.1.145-android14-11-maybe-dirty contains a POSIX CPU timer use-after-free vulnerability that can be exploited to obtain root privileges and load KernelSU. https://packetstorm.news/download/238551...

WordPress Akismet 3.1.4 Cross Site Scripting

WordPress Akismet plugin versions 2.5.0 through 3.1.4 contain a stored cross site scripting vulnerability. This proof of concept submits a crafted payload that executes when viewed by an administrator. https://packetstorm.news/download/238548...

Microsoft Windows 11 23H2 Privilege Escalation

Microsoft Windows 11 version 23H2 contains a privilege escalation vulnerability. This proof of concept races Kernel Streaming clock event handling to modify SeDebugPrivilege and launch a command prompt as SYSTEM. https://packetstorm.news/download/238539...

pac4j-jwt 6.3.2 JWE Authentication Bypass

pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability when JwtAuthenticator processes encrypted JWTs. This proof of concept forges a JWE-wrapped unsigned JWT using the server public key. https://packetstorm.news/download/238529...

Apache Ambari 3.0.0 MpackManager Path Traversal

Apache Ambari version 3.0.0 MpackManager contains a path traversal vulnerability that allows an authenticated administrator to write arbitrary files outside the management-pack staging directory. !/usr/bin/env python Apache Ambari 3.0.0 MpackManager Path Traversal Arbitrary File Write Vendor: The...

ONT-4GE-RFDW V4.0.6 Authenticated OS Command Injection

ONT-4GE-RFDW versions V4.0.0-210811 and V4.0.6 contain an authenticated OS command injection vulnerability in the Ping Diagnostics Host Address field. A proof of concept demonstrates command execution through this input. https://packetstorm.news/download/238195...

Apache DevLake 1.0.3 Unauthenticated Server-Side Request Forgery

Apache DevLake version 1.0.3 exposes an unauthenticated connection-test endpoint that can be used to issue requests to arbitrary internal HTTP/HTTPS services. Apache DevLake 1.0.3 Unauthenticated SSRF Vendor: The Apache Software Foundation Product web page: https://devlake.apache.org Affected...

AXIS Camera Station Pro Versions Before 6.20 Database Backup Decryption

AXIS Camera Station Pro versions before 6.20 and AXIS Camera Station 5 contain an insufficient database-backup encryption scheme that permits offline decryption of stored secrets. This proof of concept derives the AES key from a volume serial and decrypts encrypted values...

TianoCore EDK II PXE ICMP Error Buffer Overflow

TianoCore EDK II contains a buffer overflow in UefiPxeBcDxe ICMP error handling. This proof of concept harness sends oversized ICMP error packets during PXE boot against a local QEMU/OVMF lab. https://packetstorm.news/download/238194...

EDK II Master PXE ICMP Error Buffer Overflow

EDK II master version as of 2026-09-14 contains an ICMP error handling buffer overflow in its PXE driver. This submission provides denial of service and experimental remote code execution proof of concept scripts for an isolated QEMU PXE environment. https://packetstorm.news/download/238180...

PHP 8.5.11 Remote Code Execution

PHP version 8.5.11 and earlier affected releases contain out-of-memory corruption and stale global state flaws that can allow unauthenticated remote code execution. This proof of concept targets PHP 8.4.26 with Apache. https://packetstorm.news/download/238177...

Pocket 8.33.0.0 DOM-Based Cross Site Scripting

Pocket versions through version 8.33.0.0 contain a DOM-based cross site scripting vulnerability in articleview-mobile.js that allows crafted saved HTML to execute JavaScript in the application WebView. https://packetstorm.news/download/238178...

SpiderMonkey 155.0 JIT Miscompilation

Mozilla SpiderMonkey version 155.0 contains a JIT miscompilation in non-strict this boxing that can result in a stale-slot use-after-free Value write. The proof of concept demonstrates the condition. https://packetstorm.news/download/238179...

Apple macOS Local Privilege Escalation

Apple macOS contains a local privilege escalation vulnerability that permits an unprivileged active console user to run root commands through the com.apple.xpc.uscwoap launchd job. https://packetstorm.news/download/238175...

Arm Mali GPU Kernel Driver r39p1 Use-After-Free

Arm Mali GPU Kernel Driver version r39p1 contains a use-after-free vulnerability. This proof of concept demonstrates local privilege escalation on supported Android firmware. https://packetstorm.news/download/238174...

Apache Camel 4.22.1 XQuery XML External Entity

Apache Camel version 4.22.1 camel-saxon XQueryBuilder resolves external entities when evaluating an already-built stream-based Source, allowing readable file contents or internal HTTP responses to be included in the query result. https://packetstorm.news/download/238173...

Apache Camel 4.22.1 Docling Output Path Traversal

Apache Camel version 4.22.1 camel-docling passes the CamelDoclingOutputFilePath header directly to Docling's output-directory option, allowing conversion output to be written to an attacker-selected writable directory. The supplied proof of concept demonstrates the issue in Spring Boot and Quarku...

Collabora Online Built-in CODE Server 26.4.302 Command Injection

Collabora Online Built-in CODE Server versions before 26.4.303, bundled as the Nextcloud richdocumentscode app, contain an unauthenticated OS command injection in proxy.php when CODE is not running. The proof of concept writes and accesses a PHP web shell on the target...

Jenkins 2.441 Arbitrary File Read

Jenkins version 2.441 and earlier contains an arbitrary file read vulnerability in CLI argument expansion. The included proof of concept demonstrates unauthenticated disclosure through the Jenkins CLI. https://packetstorm.news/download/238176...

Apache Camel 4.22.1 Expired Token Acceptance

Apache Camel version 4.22.1 camel-keycloak with token introspection enabled can cache an active result past token expiry, allowing a recently expired token to be accepted. The included proof of concept demonstrates the issue using a local stand-in introspection endpoint...

Apache Camel 4.22.1 OAuth Token Cache Cross-Scope Token Reuse

Apache Camel version 4.22.1 camel-oauth contains a client-credentials token cache keyed only on the token endpoint and client ID, allowing profiles with different scopes or client secrets to receive a token issued under another profile's configuration. The supplied proof of concept reproduces the...

Azure Pipelines Service Applicability Detector

Azure Pipelines is an exclusively hosted service affected by a remote code execution vulnerability. This tool performs offline applicability triage against CSV or JSON service inventories and does not establish current vulnerability status or exploitability. https://packetstorm.news/download/2381...

libheif 1.23.1 Heap Buffer Overflow

libheif versions through 1.23.1 contain a heap buffer overflow when decoding crafted HEIF or AVIF files with nested iden and auxl item references that create duplicate Alpha planes. https://packetstorm.news/download/238182...

Apache Camel 4.22.1 A2A Webhook SSRF

Apache Camel versions 4.21.0 through 4.22.1 contain a server-side request forgery vulnerability in camel-a2a that accepts a webhook hostname resolving to an IPv6 unique local address. https://packetstorm.news/download/238165...

Keycloak 26.7.1 Reset-Credentials Exploitation Trace Hunt

Keycloak version 26.7.1 is affected by an unauthenticated reset-credentials flow account takeover. This PostgreSQL script searches Keycloak database records for exploitation traces. https://packetstorm.news/download/238163...

Microsoft Windows 11 24H2 Windows Error Reporting Local Privilege Escalation

Microsoft Windows 11 version 24H2 Windows Error Reporting contains an argument injection vulnerability in the Time Travel Debugging path. A proof of concept submits a crafted WER request that causes TTTracer to launch an attacker-controlled executable with the elevated collector token...

Apache Camel 4.22.1 CoAP Information Disclosure

Apache Camel version 4.22.1 camel-coap consumers disclose exception messages to remote CoAP clients when response construction fails after route completion. The proof of concept demonstrates disclosure through failed body and header conversion. https://packetstorm.news/download/238164...

WordPress 7.1.3 Brotli Decoder Remote Code Execution

WordPress version 7.1.3 Docker Official Image includes a vulnerable Brotli decoder. A proof of concept uses an unauthenticated XML-RPC pingback to trigger crafted Brotli decoding and execute a fixed command in the supplied isolated lab. https://packetstorm.news/download/238156...

Apple iOS 27.0.1 CoreMedia File Descriptor Leak

Apple iOS version 26.5 through 27.0.1 CoreMedia contains a permissions issue that allows a sandboxed app to obtain file descriptors for media-library files via the mediaplaybackd bytestream XPC service. The proof of concept demonstrates read access, directory enumeration, and a file-existence...

Apache Camel 4.22.1 S3 Key Expression Injection

Apache Camel versions from 4.8.0 before 4.18.5 and from 4.19.0 before 4.22.2 evaluate Simple expressions in an S3 object key supplied through the CamelAwsS3Key header. The proof of concept demonstrates exposure of process properties using an in-memory S3 client...