CVE-2026-75823

The User Frontend WordPress plugin (versions 3.5.29 through 4.3.11 ) contains a vulnerability allowing unauthenticated privilege escalation . The root cause is a failure to prevent tampering with the role assigned by the plugin's registration form. This specifically affects installations where a ...

EUVD-2026-89639

The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to register with a higher privileged role, such as Editor. This affects installations running a PHP build where the sodium extension is...

AZL-105639 CVE-2026-103111 affecting package php 8.3.33-1

PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data...

CLEANSTART-2026-AP36720 Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings

Security vulnerability affects the tempo package. Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings...

EUVD-2026-89469

The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web server...

PT-2026-103188

Custom role PHP Object Injection in WP ERP = 1.17.9 versions...

CVE-2026-96832: Deserialization of Untrusted Data

Shop manager PHP Object Injection in Content Egg = 6.3.1 versions...

PT-2026-103171

Editor PHP Object Injection in Responsive Slider Gallery = 1.5.5 versions...

PT-2026-103631

Name of the Vulnerable Software and Affected Versions simple-php-router versions prior to 5.4.1.8 Description The IpRestrictAccess middleware contains a flaw that allows remote unauthenticated attackers to bypass IP whitelist and blacklist protections. By spoofing the X-Forwarded-For,...

PT-2026-103328

Name of the Vulnerable Software and Affected Versions OrdaSoft Joomla CCK versions prior to 8.3.16 Description An unauthenticated remote code execution issue exists in the site/uploader.php endpoint, which is accessible via the getContent task. The system fails to perform authentication or Access...

CVE-2026-95531: Deserialization of Untrusted Data

Subscriber PHP Object Injection in Conversational Forms for ChatBot = 1.5.0 versions...

PT-2026-103242

Subscriber PHP Object Injection in ShortPixel Image Optimizer = 6.5.5 versions...

CVE-2026-103474: Unrestricted Upload of File with Dangerous Type

yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the serv...

Rocky Linux 9.6 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc (ALMALINUX9.6:CLSA-2026:1768300005)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1768300005 advisory. - In PHP versions:8.1. before 8.1.34, 8.2. before 8.2.30, 8.3. before 8.3.29, 8.4. before 8.4.16, 8.5. before 8.5.1, a heap buffer overflow...

CentOS Linux 8.5 [TuxCare] Security Update: php-cli / php-common / php-dba / php-fpm / php-mbstring / etc (CENTOS8.5:CLSA-2025:1745530523)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2025:1745530523 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL...

PT-2026-103184

Contributor PHP Object Injection in DesignSetGo = 2.8.0 versions...

PT-2026-103507

Contributor PHP Object Injection in Schema & Structured Data for WP & AMP = 1.66 versions...

PT-2026-103170

Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer = 2.33.6 versions...

PT-2026-103039

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote co...

Linux Distros Unpatched Vulnerability : CVE-2026-102601

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by...