PT-2026-103488

Contributor PHP Object Injection in Photo Gallery by 10Web = 1.8.46 versions...

CVE-2026-102377: Deserialization of Untrusted Data

Contributor PHP Object Injection in Photo Gallery by 10Web = 1.8.46 versions...

CVE-2026-96831: Deserialization of Untrusted Data

Contributor PHP Object Injection in Themify Builder = 7.8.1 versions...

PT-2026-103217

Editor PHP Object Injection in Ultimate Addons for Contact Form 7 = 3.5.51 versions...

PT-2026-103189

Custom role PHP Object Injection in eCommerce Product Catalog = 3.6.0 versions...

CVE-2026-102392: Deserialization of Untrusted Data

Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields = 3.3.8 versions...

PT-2026-103022

The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to register with a higher privileged role, such as Editor. This affects installations running a PHP build where the sodium extension is...

PT-2026-103499

yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the serv...

CVE-2026-103474: Unrestricted Upload of File with Dangerous Type

yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the serv...

PT-2026-103188

Custom role PHP Object Injection in WP ERP = 1.17.9 versions...

CVE-2026-97256: Deserialization of Untrusted Data

Editor PHP Object Injection in Page Builder by SiteOrigin = 2.36.0 versions...

PT-2026-103039

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote co...

PT-2026-103158

Shop manager PHP Object Injection in Music Player for WooCommerce = 1.9.1 versions...

CVE-2026-97246: Deserialization of Untrusted Data

Subscriber PHP Object Injection in ShortPixel Image Optimizer = 6.5.5 versions...

PT-2026-103215

Contributor PHP Object Injection in Themify Builder = 7.8.1 versions...

CVE-2026-94677: Deserialization of Untrusted Data

Shop manager PHP Object Injection in Kadence WooCommerce Email Designer = 1.5.19.1 versions...

CentOS Linux 6 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-devel / etc (CENTOS6:CLSA-2026:1779202666)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1779202666 advisory. - In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, and 8.5. before 8.5.6, when a SOAP server has a typemap configured,...

CentOS Linux 8 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc (CENTOS-STREAM8:CLSA-2026:1778670864)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1778670864 advisory. - In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, 8.5. before 8.5.6, due to improper sanitation of user data,...

PT-2026-103161

Shop manager PHP Object Injection in Cost of Goods for WooCommerce = 3.5.2 versions...

CVE-2026-103592: Use of Less Trusted Source

simple-php-router through 5.4.1.7 contains an IP restriction bypass vulnerability in the IpRestrictAccess middleware that allows remote unauthenticated attackers to bypass IP whitelist and blacklist protections. Attackers can spoof X-Forwarded-For, CF-Connecting-IP, or Client-IP headers to...