The most featured CVEs in this week’s security newsletters, with public Proof-of-Concepts, ordered by mention count.

For the most up-to-date and accurate info, visit the NIST links. Always audit PoCs thoroughly before running them. I don’t vouch for any links in this list: follow them with caution.

CVE-2026-109618 NEW

• Severity: 8.1 HIGH
• Impacted Products: PHP 8.2 before 8.2.35, PHP 8.3 before 8.3.36, PHP 8.4 before 8.4.27, PHP 8.5 before 8.5.12, PHP 5.4 through 8.1
• Description: PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27, and 8.5 before 8.5.12, as well as legacy unsupported PHP branches from 5.4 through 8.1, contain an Out-of-Memory (OOM) bailout state corruption and Use-After-Free (UAF) / uninitialized pointer dereference vulnerability in the core Zend Engine and extensions.
• Remediation:
  • [R1] Stand-alone Security Patch Available for Tenable Security Center Versions 6.6.0, 6.7.2, 6.8.0, 6.9.1: SC-202610.2 - Security Advisory | Tenable®
  • [R1] Stand-alone Security Patch Available for Tenable Enclave Security Versions 1.7.0, 1.8.0, 1.9.1: SC-202610.2 - Security Advisory | Tenable®
  • Important: php security update
• More Info: NVD - CVE-2026-109618
• PoC:
  • https://github.com/delvin-45/php2shell-CVE-2026-109618-CVE-2026-109619-PoC
  • https://github.com/devzyai/CVE-2026-109618-POC
  • https://github.com/Zer061/CVE-2026-109618

CVE-2026-109619 NEW

• Severity: 8.1 HIGH
• Impacted Products: PHP 8.2 before 8.2.35, PHP 8.3 before 8.3.36, PHP 8.4 before 8.4.27, PHP 8.5 before 8.5.12, PHP 5.4 through 8.1
• Description: PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27, and 8.5 before 8.5.12, as well as legacy unsupported PHP branches from 5.4 through 8.1, contain a cross-request use-after-free vulnerability in worker request lifecycle and global state management across multiple server application programming interfaces (SAPIs), including Apache mod_php and PHP-FPM.
• Remediation:
  • [R1] Stand-alone Security Patch Available for Tenable Security Center Versions 6.6.0, 6.7.2, 6.8.0, 6.9.1: SC-202610.2 - Security Advisory | Tenable®
  • [R1] Stand-alone Security Patch Available for Tenable Enclave Security Versions 1.7.0, 1.8.0, 1.9.1: SC-202610.2 - Security Advisory | Tenable®
  • Important: php security update
• More Info: NVD - CVE-2026-109619
• PoC:
  • https://github.com/jeffschafer/Bigfix-PHP-Vulnerability-Scanner-Content-CVE-2026-109618-CVE-2026-109619
  • https://github.com/dev-maple/php2shell-CVE-2026-109619
  • https://github.com/Karasawa2025/php2shell-lab

CVE-2026-104935

• Severity: 8.6 HIGH
• Impacted Products: Ivanti Connect Secure 22.8R1, Ivanti Connect Secure 22.8R2.4, Ivanti Connect Secure release 25.1.1 (builds 0 and 1), Ivanti Connect Secure release 25.1.2 (builds 0 through 2)
• Description: Ivanti Connect Secure versions 22.8R1 through 22.8R2.4, release 25.1.1 (builds 0 and 1), and release 25.1.2 (builds 0 through 2) contain an authentication bypass by spoofing (CWE-290) and a time-of-check time-of-use race condition (CWE-362) in the legacy CGI web request routing and Windows File Share archive upload handler that allow an unauthenticated remote attacker to execute arbitrary code as the unprivileged cgi-server (nr) user.
• Remediation:
  • Security Advisory Ivanti Connect Secure (CVE-2026-104935)
  • Ivanti Connect Secure welcome.cgi and wu.cgi Authentication Bypass and Race Condition Remote Code Execution Vulnerability
• More Info: NVD - CVE-2026-104935
• PoC:
  • https://github.com/ApexBreach/CVE-2026-104935-Proof-of-concept
  • https://github.com/0x45dd/ivanti-cve-2026-104935-check

CVE-2026-96656 NEW

• Severity: 7.2 HIGH
• Impacted Products: Plex Media Server
• Description: An arbitrary file write and dynamic library injection vulnerability exists in the transcoding and codec loading subsystem of Plex Media Server due to unsanitized passthrough of the TranscoderH264Options server preference to libx264 and unverified loading of shared libraries from the Codecs directory.
• Remediation:
  • Important Security Update for Plex Media Server (v1.43.2 and earlier)
  • Plex Media Server Release Notes 1.43.3.10861
• More Info: NVD - CVE-2026-96656
• PoC:
  • https://github.com/code-zm/plex2shell

CVE-2026-96655 NEW

• Severity: 4.3 MEDIUM
• Impacted Products: Plex Media Server
• Description: A server-side request forgery (SSRF) vulnerability exists in the Universal Transcoder HTTP service of Plex Media Server due to missing validation of the path query parameter. An authenticated remote attacker can exploit this issue to induce the server and its transcoder subprocess to issue arbitrary outbound HTTP requests and ingest attacker-controlled XML media manifests and video streams.
• Remediation:
  • Plex Media Server 1.43.3.10861 Release Announcements
• More Info: NVD - CVE-2026-96655
• PoC:
  • https://github.com/code-zm/plex2shell

CVE-2026-96652 NEW

• Severity: 5.8 MEDIUM
• Impacted Products: Plex Media Server prior to version 1.43.3.10861
• Description: A server-side request forgery (SSRF) vulnerability exists in Plex Media Server prior to version 1.43.3.10861 within the Companion player timeline HTTP handlers (/player/timeline/poll, /player/timeline/subscribe, and /player/timeline/unsubscribe).
• Remediation:
  • Important Security Update for Plex Media Server v1.43.2 and earlier
  • Plex Media Server 1.43.3.10861 Release Notes
• More Info: NVD - CVE-2026-96652
• PoC:
  • https://github.com/code-zm/plex2shell

CVE-2026-21589

• Severity: Unknown
• Impacted Products: Bamboo Data Center, Bitbucket Data Center, Confluence Data Center, Crowd Data Center, Jira Service Management Data Center
• Description: Multiple Atlassian products, including Bamboo Data Center, Bitbucket Data Center, Confluence Data Center, Crowd Data Center, Jira Service Management Data Center, Jira Software Data Center, Crucible, and Fisheye, are affected by a path traversal vulnerability that permits arbitrary file access. An unauthenticated remote attacker can exploit this flaw to read specific files located within the web application root directory.
• Remediation:
  • CVE-2026-21589 - Arbitrary File Access Vulnerability impacts Multiple Products | Atlassian Support | Atlassian Documentation
  • [BAM-26567] Arbitrary File Access in Bamboo Data Center - Create and track feature requests for Atlassian products.
  • [BSERV-20604] Arbitrary File Access in Bitbucket Data Center - Create and track feature requests for Atlassian products.
• More Info: NVD - CVE-2026-21589
• PoC:
  • https://github.com/tc4dy/CVE-2026-21589-PoC-Exploit
  • https://github.com/0xBlackash/CVE-2026-21589
  • https://github.com/renzi25031469/CVE-2026-21589

CVE-2026-105134 NEW

• Severity: 7.2 HIGH
• Impacted Products: Ahsay Cloud Backup Suite (AhsayCBS) 7, Ahsay Cloud Backup Suite (AhsayCBS) 8, Ahsay Cloud Backup Suite (AhsayCBS) 9 (prior to version 9.15.2 hotfix build 70), Ahsay Cloud Backup Suite (AhsayCBS) 10 (up to and including version 10.3.4 server build 25, prior to hotfix build 45)
• Description: An operating system command injection vulnerability exists in the Replication Receiver component of Ahsay Cloud Backup Suite (AhsayCBS) across release branches 7, 8, 9 (prior to version 9.15.2 hotfix build 70), and 10 (up to and including version 10.3.4 server build 25, prior to hotfix build 45).
• Remediation:
  • (Update) Critical Security Alert: Immediate Action Required for CVE-2026-105133 and CVE-2026-105134 | Ahsay Backup
• More Info: NVD - CVE-2026-105134
• PoC:
  • https://github.com/RayanAlmulhim/CVE-2026-105134-lab

CVE-2026-102764 NEW

• Severity: 9.1 CRITICAL
• Impacted Products: BeyondTrust Remote Support, BeyondTrust Privileged Remote Access
• Description: BeyondTrust Remote Support (formerly Bomgar) and BeyondTrust Privileged Remote Access contain an authentication bypass by spoofing vulnerability (CWE-290) within the internal messaging subsystem (brain and thin-scc ELF service binaries) that exposes the public /nw WebSocket endpoint over HTTPS.
• Remediation:
  • ARMORY CASTLE and BT26-05: What Security Teams Need to Know | BeyondTrust
  • BT26-05 | BeyondTrust
• More Info: NVD - CVE-2026-102764
• PoC:
  • https://github.com/Worthes/CVE-2026-102764-Proof-of-concept

CVE-2026-97229

• Severity: 10.0 CRITICAL
• Impacted Products: GitLab Community Edition (CE) 19.2.0 prior to 19.2.8, GitLab Enterprise Edition (EE) 19.2.0 prior to 19.2.8, GitLab Community Edition (CE) 19.3.0 prior to 19.3.5, GitLab Enterprise Edition (EE) 19.3.0 prior to 19.3.5, GitLab Community Edition (CE) 19.4.0 prior to 19.4.2
• Description: An integer overflow vulnerability exists in the CI/CD regular expression compiler in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.2.0 prior to 19.2.8, 19.3.0 prior to 19.3.5, and 19.4.0 prior to 19.4.2. The flaw occurs due to insufficient validation of regular expression repetition quantifiers and compiled bytecode program sizes when processing CI/CD configuration files.
• Remediation:
  • GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8 | GitLab Docs
• More Info: NVD - CVE-2026-97229
• PoC:
  • https://github.com/jburgess-r7/CVE-2026-97229-PoC

CVE-2026-110130 NEW

• Severity: 10.0 CRITICAL
• Impacted Products: Finsys Dockhand prior to 1.0.45
• Description: Finsys Dockhand prior to 1.0.45 contains an authentication bypass and fail-open authorization vulnerability in the SvelteKit request handling hook (src/hooks.server.ts) and user management API endpoints (src/routes/api/users/[id]/+server.ts).
• Remediation:
  • Finsys Dockhand v1.0.45 Release Notes
  • Finsys Dockhand Authentication Bypass via Static Asset Check (GHSA-r3mg-r5vm-3v6w)
• More Info: NVD - CVE-2026-110130
• PoC:
  • https://github.com/Finsys/dockhand/security/advisories/GHSA-r3mg-r5vm-3v6w

CVE-2026-106173 NEW

• Severity: 9.8 CRITICAL
• Impacted Products: Fortinet FortiSIEM 7.5.0
• Description: A path traversal vulnerability exists in the phQueryMaster daemon of Fortinet FortiSIEM 7.5.0 that allows an unauthenticated remote attacker to write arbitrary files and execute arbitrary code or commands.
• Remediation:
  • PSIRT | FortiGuard Labs
• More Info: NVD - CVE-2026-106173
• PoC:
  • https://github.com/0xBlackash/CVE-2026-106173
  • https://github.com/horizon3ai/CVE-2026-106173
  • https://github.com/aduli198/CVE-2026-106173

CVE-2026-105445 NEW

• Severity: Unknown
• Impacted Products: Docker Hub
• Description: An Incorrect Privilege Assignment vulnerability in Docker Hub’s account-to-organization conversion feature allowed an authenticated attacker to reassign a personal access token (PAT) they controlled to another Docker Hub user without rotating or revoking the token secret. The unchanged PAT then authenticated to the registry as the recipient and could pull, push, or delete images, within its scopes, in repositories accessible to that user, including organization repositories.
• Remediation:
  • Docker Hub Security Advisory: CVE-2026-105445 | Docker
• More Info: NVD - CVE-2026-105445
• PoC:
  • https://github.com/Mothchui/CVE-2026-105445

CVE-2026-103849 NEW

• Severity: 10.0 CRITICAL
• Impacted Products: Adobe Commerce, Adobe Commerce B2B, Magento Open Source
• Description: Adobe Commerce, Adobe Commerce B2B, and Magento Open Source are affected by an improper neutralization of special elements used in a server-side layout and directive rendering engine vulnerability (CWE-1336) that allows an unauthenticated remote attacker to execute arbitrary code.
• Remediation:
  • Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
  • Adobe Security Bulletin APSB26-153 for Adobe Commerce and Magento Open Source
• More Info: NVD - CVE-2026-103849
• PoC:
  • https://github.com/dinosn/cve-2026-103849-blockstrap-lab

CVE-2026-66066 NEW

• Severity: 9.8 CRITICAL
• Impacted Products: Ruby on Rails Active Storage
• Description: Ruby on Rails Active Storage is affected by an arbitrary file read vulnerability when configured to process image variants using libvips. An unauthenticated remote attacker can exploit this issue by uploading a crafted file to access sensitive server files, which can subsequently enable remote code execution.
• Remediation:
  • Security Bulletin: Multiple vulnerabilities affect IBM License Metric Tool
  • [SECURITY] [DSA 6546-1] rails security update
  • Security Bulletin: Multiple vulnerabilities in IBM Aspera Enterprise Webapps
• More Info: NVD - CVE-2026-66066
• PoC:
  • https://github.com/ivanesk315/CVE-2026-66066
  • https://github.com/0xBlackash/CVE-2026-66066
  • https://github.com/honghyewon29/CVE-2026-66066

CVE-2026-42208

• Severity: 10.0 CRITICAL
• Impacted Products: LiteLLM
• Description: LiteLLM is affected by a pre-authentication SQL injection vulnerability in its proxy component that allows for unauthorized database access. This flaw occurs when the application improperly handles user-supplied input within the Authorization header during API key verification.
• Remediation:
  • SQL injection in Proxy API key verification · Advisory · BerriAI/litellm · GitHub
• More Info: NVD - CVE-2026-42208
• PoC:
  • https://github.com/rootdirective-sec/cve-2026-42208-Lab
  • https://github.com/0xBlackash/CVE-2026-42208
  • https://github.com/imjdl/CVE-2026-42208_lab

CVE-2026-111497 NEW

• Severity: 8.1 HIGH
• Impacted Products: Google Brotli 1.0.3 through 1.0.9, 1.1.0, 1.2.0, Node.js, Bun
• Description: Google Brotli versions 1.0.3 through 1.0.9, 1.1.0, and 1.2.0 are affected by an out-of-bounds write vulnerability in the decompression module that can lead to remote code execution. Downstream runtimes, proxies, and applications bundling or linking the library, including Node.js, Bun, Python Brotli packages, Microsoft .NET, Envoy Proxy, Istio, PHP for Windows, and Palo Alto Networks PAN-OS, are exposed to this flaw when decompressing untrusted Brotli data.
• Remediation:
  • CVE-2026-111497 Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products
  • Important: firefox security update
  • Important: firefox security update
• More Info: NVD - CVE-2026-111497
• PoC:
  • https://github.com/tikarammardi/CVE-2026-111497
  • https://github.com/lesterlam/node2shell
  • https://github.com/dimasma0305/CVE-2026-111497-POC

CVE-2026-110264 NEW

• Severity: 10.0 CRITICAL
• Impacted Products: GitLab Community Edition, GitLab Enterprise Edition
• Description: GitLab Community Edition (CE) and Enterprise Edition (EE) contain an integer overflow vulnerability in the bundled Onigmo regular expression engine within Ruby when compiling regular expressions with a large number of range repeat quantifiers. Unauthenticated remote attackers can exploit this flaw by supplying a specially crafted document that triggers excessive range repeat compilation, resulting in an out-of-bounds memory write and arbitrary code execution as the service user.
• Remediation:
  • VuXML: Gitlab – vulnerabilities
  • GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13 | GitLab Docs
• More Info: NVD - CVE-2026-110264
• PoC:
  • https://github.com/googlesky/CVE-2026-110264
  • https://github.com/al4n4n/CVE-2026-110264

References

This list was scraped from the quite amazing and highly recommended newsletters below:

• ~this week in security~
• Unsupervised Learning
• @RISK
• Hive Five
• Vulnerable U
• tl;dr sec

Thanks for reading! For corrections, omissions (e.g. newsletter recs) feel free to get in touch.