PT-2026-89297

Name of the Vulnerable Software and Affected Versions Site Reviews versions 7.2.2 through 8.2.9 Description The plugin fails to prevent request data from being deserialized. It derives the key protecting this data by padding the site's WordPress nonce key, which can be publicly computed if the ke...

CVE-2026-73699: Deserialization of Untrusted Data

FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary code by exploiting incorrect options passed to unserialize in the Perms::getPerms method, where a positional array is used instead of the required named-key array to...

CVE-2026-88879: Authentication Bypass by Spoofing

Traefik is an HTTP reverse proxy and load balancer. In Traefik v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11, header names are canonicalized only on dashes, so X-Auth-User, XAuthUser and X.Auth.User are treated as three distinct headers by Traefik, while backends that derive variable...

CVE-2026-81784: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in Marcin Wise Chat wise-chat allows Object Injection.This issue affects Wise Chat: from n/a through 3.4.2...

PT-2026-89499

FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary code by exploiting incorrect options passed to unserialize in the Perms::getPerms method, where a positional array is used instead of the required named-key array to...

CVE-2026-38626

Garlic-Hub v1.0.1 is vulnerable to SQL Injection due to the improper neutralization of special elements used in an SQL command. The flaw is located within the src/Modules/Items/Repositories/ItemsRepository.php file. This vulnerability allows for unauthorized access to or manipulation of the under...

CVE-2026-38626

Garlic-Hub v1.0.1 is vulnerable to SQL Injection in src/Modules/Items/Repositories/ItemsRepository.php...

PT-2026-89431

Name of the Vulnerable Software and Affected Versions Wise Chat versions prior to 3.4.2 Description An issue involving the deserialization of untrusted data allows for Object Injection. Object Injection occurs when untrusted data is used to abuse the logic of a deserialization function, potential...

CVE-2026-79987: Use of Externally-Controlled Input to Select Classes or Code

A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker...

PT-2026-89513

Name of the Vulnerable Software and Affected Versions MongoDB PHP Library affected versions not specified Description Improper neutralization of special elements in the data query logic of the GridFS component allows a structured file identifier provided by a caller to be interpreted as a query...

VulnCheck KEV: CVE-2024-50340

symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the registerargvargc php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by...

PT-2026-89257

Name of the Vulnerable Software and Affected Versions BurgerEditor versions 3.2.0 through 3.4.0 Description An issue exists allowing the unrestricted upload of files with dangerous types. An authenticated attacker can upload arbitrary files, which may lead to the execution of arbitrary PHP code o...

CVE-2026-84063: Unrestricted Upload of File with Dangerous Type

BurgerEditor 3.2.0 through 3.4.0 contains an issue with unrestricted upload of file with dangerous type. If this vulnerability is exploited, an arbitrary file may be uploaded by an attacker who can log in to the product, potentially allowing arbitrary PHP code to be executed...

Ubuntu 16.04 LTS : PHP vulnerabilities (USN-8734-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8734-1 advisory. It was discovered that PHP incorrectly handled Apache map decoding in SOAP servers with a typemap configured. A remote attacker could use this issue to...

CLSA-2026-1788973862 TuxCare security update for league/commonmark (4 CVEs)

TuxCare rebuilt league/commonmark to address 4 CVEs. Fixed in 2.8.2-p3+tuxcare...

CVE-2026-87930 MaxSite CMS through 109.6 PHP Object Injection via ci_session

MaxSite CMS through 109.6 passes the cisession cookie to unserialize without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies using the hardcoded encryption key to trigger magic methods and corrupt application state or achieve...

CVE-2026-87930

MaxSite CMS through version 109.6 is affected by a PHP Object Injection vulnerability in the ci_session cookie handling. The Session library passes the cookie value to unserialize() without class restrictions, and a hardcoded encryption key allows unauthenticated attackers to forge valid session ...

CVE-2026-87930 MaxSite CMS through 109.6 PHP Object Injection via ci_session

MaxSite CMS through 109.6 passes the cisession cookie to unserialize without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies using the hardcoded encryption key to trigger magic methods and corrupt application state or achieve...

CVE-2024-58382

league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in...

EUVD-2024-55755

league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in...