PT-2026-103022

The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to register with a higher privileged role, such as Editor. This affects installations running a PHP build where the sodium extension is...

PT-2026-103161

Shop manager PHP Object Injection in Cost of Goods for WooCommerce = 3.5.2 versions...

PT-2026-103163

Contributor PHP Object Injection in SEO Plugin by Squirrly SEO = 14.2.5 versions...

PT-2026-103499

yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the serv...

CVE-2026-103474: Unrestricted Upload of File with Dangerous Type

yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the serv...

PT-2026-103188

Custom role PHP Object Injection in WP ERP = 1.17.9 versions...

CVE-2026-97256: Deserialization of Untrusted Data

Editor PHP Object Injection in Page Builder by SiteOrigin = 2.36.0 versions...

PT-2026-103039

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote co...

PT-2026-103158

Shop manager PHP Object Injection in Music Player for WooCommerce = 1.9.1 versions...

CVE-2026-94122: Deserialization of Untrusted Data

Editor PHP Object Injection in Responsive Slider Gallery = 1.5.5 versions...

CVE-2026-96832: Deserialization of Untrusted Data

Shop manager PHP Object Injection in Content Egg = 6.3.1 versions...

CVE-2026-103592: Use of Less Trusted Source

simple-php-router through 5.4.1.7 contains an IP restriction bypass vulnerability in the IpRestrictAccess middleware that allows remote unauthenticated attackers to bypass IP whitelist and blacklist protections. Attackers can spoof X-Forwarded-For, CF-Connecting-IP, or Client-IP headers to...

CVE-2026-94677: Deserialization of Untrusted Data

Shop manager PHP Object Injection in Kadence WooCommerce Email Designer = 1.5.19.1 versions...

Linux Distros Unpatched Vulnerability : CVE-2026-102601

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by...

CentOS Linux 8.5 [TuxCare] Security Update: php-cli / php-common / php-dba / php-fpm / php-mbstring / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2025:1744723558)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2025:1744723558 advisory. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number...

CentOS Linux 8 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1779125079)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1779125079 advisory. - In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, and 8.5. before 8.5.6, the PDO Firebird driver...

CentOS Linux 6 [TuxCare] Security Update: cups / cups-devel / cups-libs / cups-lpd / cups-php (CENTOS6:CLSA-2026:1785399587)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1785399587 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900...

CentOS Linux 7 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-devel / etc (CENTOS7:CLSA-2024:1729628764)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2024:1729628764 advisory. - In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3. before 8.3.12, HTTPREDIRECTSTATUS variable is used to check whether or not CGI...

AlmaLinux 9.6 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc (ALMALINUX9.6:CLSA-2026:1780513989)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1780513989 advisory. - In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, 8.5. before 8.5.6, due to improper sanitation of user data, it...

CentOS Linux 7 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-devel / etc (CENTOS7:CLSA-2024:1730141462)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2024:1730141462 advisory. - In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3. before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST...