DevCurrent — verified software releases and security updates
Track important releases, vulnerabilities, and practical actions for modern software stacks.
Highest priority right now
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.
Redis is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.
PHP, specifically Windows-based PHP used in CGI mode, contains an OS command injection vulnerability that allows for arbitrary code execution. This vulnerability is a patch bypass
Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.
In some versions of PHP in certain configurations of FPM setup, it is possible to cause FPM module to write past allocated buffers allowing the possibility of remote code execution
All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root.
Laravel Framework RCE Vulnerability