PHP shares mitigation for unpatched RCE CVE-2026-115560
Only unusual session-handler setups are affected; admins should keep session.upload_progress.enabled set to 0 until the next release.
Stories per day · 30 days
2 RSS
Relatedcwe-224dcm4che4j4care4path-traversal4syss4godot2heap-overflow2memory-corruption2binary-resource1dicom1hdr1image-loader1php1php2shell1rce1session-handling1untrusted-file1
12 stories, newest first · one card per story
Stories tagged #unpatched
[SYSS-2026-080]: dcm4che - Path Traversal (CWE-22)
SySS disclosed an unpatched high-risk path traversal in dcm4che 5.35.0, with no CVE yet.
Godot 4.x: heap out-of-bounds write via negative string length in binary resource loader
Godot 4.x binary resource loader has an unpatched heap out-of-bounds write via negative string length.
Unpatched cross-namespace secret exfiltration in GoogleCloudPlatform/k8s-config-connector - CVE requested (CAN-2026-2039460)
An unpatched Config Connector flaw can exfiltrate secrets across Kubernetes namespaces after Google did not substantively respond.
Unpatched AhsayCBS Vulnerabilities Exploited in the Wild
Huntress says attackers are exploiting unpatched AhsayCBS flaws for unauthenticated RCE, webshells, and cryptominers.
Critical LMCache RCE Vulnerability Remains Unpatched, Public PoC Exploit Available
Unpatched LMCache flaw CVE-2026-105192 allows unauthenticated remote code execution, and JFrog published a PoC.
9
FBI Blames Contractor’s Missed Patch for ShinyHunters Breach
The FBI removed an Accenture contractor after an unpatched Oracle PeopleSoft system let ShinyHunters expose employee records.
2
Frequently asked questions about reported Citrix NetScaler zero-day vulnerabilities
Two unpatched Citrix NetScaler zero-days enabling remote code execution are reportedly under active attack, with no vendor patch.
[SYSS-2026-070]: GDCM (Grassroots DICOM) - Integer Overflow (CWE-190)
SySS disclosed unpatched high-risk integer overflow SYSS-2026-070 in GDCM 3.3.0, with no CVE.
Unpatched OnePlus Flaws Let Installed Android Apps Gain Root Without Permissions
Unpatched OnePlus flaws let a no-permission Android app gain root on OxygenOS phones, with no fix released.
CVE-2026-17613: Penpot cross-team file takeover via import-binfile (unpatched in 2.17.2)
Penpot 2.17.2 still lacks the import-binfile permission check, leaving CVE-2026-17613 cross-team file takeover unpatched.
Unpatched Kaltura mwEmbed Flaws Could Let Remote Attackers Read Files and Run Code
CERT/CC disclosed unpatched Kaltura mwEmbed flaws CVE-2026-19913 and CVE-2026-19912 allowing unauthenticated file reads and remote code execution.
2