WordPress Ninja Forms - Layout & Styles plugin <= 3.0.31 - PHP Object Injection vulnerability

WordPress Ninja Forms - Layout & Styles plugin = 3.0.31 - PHP Object Injection vulnerability discovered by Marc-André Beaulieu h3dg3h0g in WordPress Plugin Ninja Forms - Layout & Styles versions = 3.0.31...

WordPress WP User Frontend plugin <= 4.3.10 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by VanTastic in WordPress Plugin WP User Frontend versions = 4.3.10...

PT-2026-84155

LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sourced and syslog-sourced data without escaping. An attacker who controls a monitored network device can inject arbitrary JavaScript through SNMP interface descriptions or syslog...

PT-2026-84455

Name of the Vulnerable Software and Affected Versions phpseclib versions prior to 3.0.57 phpseclib versions prior to 4.0.1 Description Pure-PHP X25519 scalar multiplication in phpseclib/Math/PrimeField/Integer.php performs data-dependent conditional modular reductions in the add and subtract...

ROS-20260901-73-0009

The vulnerability in PHP is related to the assignment of a null pointer. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260901-73-0013

The vulnerability of the PHP-FPM process manager, a PHP programming language interpreter, exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows an attacker to execute arbitrary JavaScript code XSS using a specially created URL address...

ROS-20260901-73-0014

The vulnerability of the PHP-FPM process manager, a PHP programming language interpreter, exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows an attacker to execute arbitrary JavaScript code XSS using a specially created URL address...

ROS-20260901-73-0015

The vulnerability of the PHP-FPM process manager, a PHP programming language interpreter, exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows an attacker to execute arbitrary JavaScript code XSS using a specially created URL address...

ROS-20260901-73-0001

The vulnerability of the SoapServer class in the PHP programming language is related to the use of memory after it is freed during the processing of the SOAPPERSISTENCESESSION parameter. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information or cause service...

ROS-20260901-73-0002

The vulnerability of the SoapServer class in the PHP programming language is related to the use of memory after it is freed during the processing of the SOAPPERSISTENCESESSION parameter. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information or cause service...

ROS-20260901-73-0003

The vulnerability of the SoapServer class in the PHP programming language is related to the use of memory after it is freed during the processing of the SOAPPERSISTENCESESSION parameter. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information or cause service...

ROS-20260901-73-0007

The vulnerability in PHP is related to the assignment of a null pointer. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260901-73-0008

The vulnerability in PHP is related to the assignment of a null pointer. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-84192: Improper Neutralization of Input During Web Page Generation

LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sourced and syslog-sourced data without escaping. An attacker who controls a monitored network device can inject arbitrary JavaScript through SNMP interface descriptions or syslog...

CVE-2026-84193: Improper Neutralization of Input During Web Page Generation

LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render unescaped SNMP-sourced data fields including BGP peer descriptions, VRF names, process information, and SLA tags. Attackers with device management access or network access to enro...

PT-2026-84156

LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render unescaped SNMP-sourced data fields including BGP peer descriptions, VRF names, process information, and SLA tags. Attackers with device management access or network access to enro...

SPIP 4.4.8 Insecure Deserialization

SPIP versions 4.4.0 through 4.4.8 contain an insecure deserialization vulnerability in the public area through the tablevaleur filter and DATA iterator. An attacker able to place malicious serialized content can trigger arbitrary object instantiation and potentially achieve remote code execution...

ROS-20260901-73-0026

The vulnerability in php-phpseclib is related to insufficient validation of incoming requests. Exploiting this vulnerability allows a malicious actor to perform SSRF attacks remotely...

CVE-2026-84372: Improper Neutralization of CRLF Sequences

Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 until version 3.3.0, pipeline handling on aggregate cluster and replication connections reparses an already serialized RESP buffer in AbstractAggregateConnection::write by splitting it with...

PT-2026-84465

Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the back query GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payloa...