PT-2026-107405

The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution feature to administrators, gating it on a content capability that the Editor role holds by default, which allows Editor-level users to save and execute arbitrary PHP code on the server and fully compromi...

CVE-2026-104677: Improper Control of Generation of Code

The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution feature to administrators, gating it on a content capability that the Editor role holds by default, which allows Editor-level users to save and execute arbitrary PHP code on the server and fully compromi...

cve-2026-87902-poc

CVE-2026-87902 — WordPress Core: path traversal non autenticato nella risoluzione dei template di pagina Inclusione locale non autenticata di file PHP in WordPress Core tramite un valore pagename con doppia codifica — e, in specifiche condizioni di deployment, esecuzione di codice PHP con i...

CVE-2026-91766 affecting package php for versions less than 8.3.35-1

CVE-2026-91766 affecting package php for versions less than 8.3.35-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-93682 affecting package php for versions less than 8.3.35-1

CVE-2026-93682 affecting package php for versions less than 8.3.35-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-1218 affecting package php for versions less than 8.3.35-1

CVE-2025-1218 affecting package php for versions less than 8.3.35-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-6103 affecting package php for versions less than 8.3.35-1

CVE-2026-6103 affecting package php for versions less than 8.3.35-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-91765 affecting package php for versions less than 8.3.35-1

CVE-2026-91765 affecting package php for versions less than 8.3.35-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-14181 affecting package php for versions less than 8.3.35-1

CVE-2025-14181 affecting package php for versions less than 8.3.35-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-91769 affecting package php for versions less than 8.3.35-1

CVE-2026-91769 affecting package php for versions less than 8.3.35-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-92842 affecting package php for versions less than 8.3.35-1

CVE-2026-92842 affecting package php for versions less than 8.3.35-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-91768 affecting package php for versions less than 8.3.35-1

CVE-2026-91768 affecting package php for versions less than 8.3.35-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-17545 affecting package php for versions less than 8.3.35-1

CVE-2026-17545 affecting package php for versions less than 8.3.35-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-91767 affecting package php for versions less than 8.3.35-1

CVE-2026-91767 affecting package php for versions less than 8.3.35-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-104070

The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu anti-forgery parameter in crayonsstore.php, causing the authorization dispatcher to resolve an...

EUVD-2026-93496

The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu anti-forgery parameter in crayonsstore.php, causing the authorization dispatcher to resolve an...

CVE-2026-104070 SPIP Crayons Plugin < 3.5.0 Authorization Bypass RCE

The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu anti-forgery parameter in crayonsstore.php, causing the authorization dispatcher to resolve an...

Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators

Impact An attacker who controls or tampers with an OpenAPI description can cause Kiota to emit attacker-controlled Java or PHP source outside a generated documentation comment. The affected sanitizers remove comment terminators rather than neutralizing them, allowing a terminator to reform from...

GHSA-RM89-RHWJ-9J92 Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators

Impact An attacker who controls or tampers with an OpenAPI description can cause Kiota to emit attacker-controlled Java or PHP source outside a generated documentation comment. The affected sanitizers remove comment terminators rather than neutralizing them, allowing a terminator to reform from...

CVE-2026-105796

Kiota is an OpenAPI based HTTP Client code generator. From 0.5.0 until 1.35.0, Kiota's Java and PHP documentation-comment sanitizers delete block-comment terminators rather than neutralizing them, allowing overlapping characters to reform a terminator and place attacker-controlled OpenAPI text...