Astra Linux – Vulnerability in libonig

Oniguruma, as used in PHP 7.3.x and other products, has a heap-based buffer over-read issue in the strlowercasematch function in regexec.c...

Astra Linux – Vulnerability in PHP 7.3

In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26, and 8.0.x below 8.0.13, certain XML parsing functions, such as simplexmlloadfile, decode the filename passed to them using URL encoding. If the filename contains a URL-encoded NUL character, this may cause the function to interpret this as t...

Fedora 43 : php (2026-d755ca77c4)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d755ca77c4 advisory. PHP version 8.4.24 30 Jul 2026 BCMath: Fixed GHSA-x692-q9x7-8c3f Out-of-bounds write in bccomp. CVE-2026-17544 Recep Asan Calendar: Fixed bug GH-226...

CVE-2026-65574

Unauthenticated PHP Object Injection in Abogado = 1.18 versions...

vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion

A flaw was found in Vim, an open-source command-line text editor. The PHP omni-completion script improperly handles specially crafted input. When a victim opens a malicious PHP file and invokes omni-completion, an unescaped class or trait name can be interpreted as Ex commands. This allows a remo...

[SECURITY] Fedora 43 Update: php-8.4.23-1.fc43

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion

A flaw was found in Vim, an open-source command-line text editor. The PHP omni-completion script improperly handles specially crafted input. When a victim opens a malicious PHP file and invokes omni-completion, an unescaped class or trait name can be interpreted as Ex commands. This allows a remo...

UBUNTU-CVE-2026-48979

PHP Standard Library PSL is set of APIs covering async, collections, networking, I/O, cryptography, terminal UI, etc. In versions 6.1.0, 6.1.1 and 6.2.0, the Psl\H2\ServerConnection does not validate that the total bytes received in DATA frames match the content-length header declared in the...

CVE-2026-40738

Unauthenticated PHP Object Injection in Eldon = 1.4.1 versions...

CVE-2026-40753

Unauthenticated PHP Object Injection in EasyMeals = 1.5.1 versions...

CVE-2026-27429

Unauthenticated PHP Object Injection in Nifty = 1.4.1 versions...

CVE-2026-40760

WordPress Behold theme

CVE-2026-40758

The CVE concerns WordPress Léonie theme versions

PT-2026-50114

Unauthenticated PHP Object Injection in TechLink = 1.3 versions...

PT-2026-50127

Name of the Vulnerable Software and Affected Versions Fusion Builder versions prior to 3.15.5 Description A PHP Object Injection issue exists in the software. This occurs when an application deserializes untrusted data, allowing an attacker to manipulate the objects created and potentially execut...

PT-2026-50118

Unauthenticated PHP Object Injection in Valeska = 1.2.2 versions...

PT-2026-49377

Name of the Vulnerable Software and Affected Versions ShortPixel Image Optimizer versions prior to 6.4.4 Description PHP Object Injection occurs in the software. This issue allows an attacker to inject malicious objects into the application, which can lead to unauthorized code execution or other...

PT-2026-46908

Name of the Vulnerable Software and Affected Versions JCE editor extension for Joomla versions 1.0.0 through 2.9.99.4 Description Improper access control in the JCE editor extension allows unauthenticated users to create new editor profiles. This flaw enables the upload and execution of arbitrary...

CVE-2025-58897

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Axiomthemes Fermentio allows PHP Local File Inclusion. This issue affects Fermentio: from n/a through 1.5.0...

CVE-2026-39276

The template upload feature in Emlog Pro v2.6.9 has a path traversal vulnerability, allowing authenticated administrators to execute arbitrary PHP code. By uploading a malicious ZIP archive containing directory traversal sequences in filenames, an attacker can overwrite default template files or...