CVE-2026-73364: Deserialization of Untrusted Data

Customer PHP Object Injection in Flexible Subscriptions = 1.8.1 versions...

PT-2026-80737

Name of the Vulnerable Software and Affected Versions mcp/sdk versions 0.5.0 through 0.7.0 Description The HTTP client transport in the MCP PHP SDK reads a Server-Sent Events SSE response stream incrementally and appends data to an in-memory buffer sseBuffer without an upper bound. The buffer is...

ROS-20260819-73-0074

The vulnerability of the unserialize function in the MediaWiki software, which is used to implement the hypertext environment, is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

CVE-2026-75956: Allocation of Resources Without Limits or Throttling

Joomla Extension - cmsjunkie.com - DOS vector in pagination parameter handling in J-BusinessDirectory 6.2.3 - Pagination values were not strictly typed. Array/non-numeric values for example limitstart could trigger PHP type errors in arithmetic, and limit was not validated before use in list...

CVE-2026-73389: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Kalles Addons = 1.0.6 versions...

CVE-2026-67364: Improper Control of Generation of Code

Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms 2.4.3.2 - The form's optional custom-PHP post-submission handler is executed via eval. The URL parameter = X shortcode is substituted with the raw, unescaped value of a query parameter, letting an unauthenticated attack...

CVE-2026-18937: Improper Control of Generation of Code

The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables, and to execute arbitrary code on the server when a classic non-block ...

PT-2026-78340

Customer PHP Object Injection in Flexible Subscriptions = 1.8.1 versions...

PT-2026-78346

Name of the Vulnerable Software and Affected Versions Kalles Addons versions prior to 1.0.7 Description An unauthenticated PHP Object Injection issue exists. PHP Object Injection occurs when untrusted input is passed to the unserialize function, allowing an attacker to manipulate serialized objec...

PT-2026-78353

Name of the Vulnerable Software and Affected Versions Balbooa Forms versions prior to 2.4.3.2 Description An unauthenticated attacker can perform PHP code injection due to the use of the eval function in the optional custom-PHP post-submission handler. The URL parameter = X shortcode is replaced...

PT-2026-78941

Name of the Vulnerable Software and Affected Versions Shuffle versions 1.8 and earlier Description An unauthenticated Local File Inclusion issue exists, allowing an attacker to read arbitrary files from the local file system without requiring authentication. Recommendations Update Shuffle to a...

RHEL 9 : php:8.2 (RHSA-2026:40416)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:40416 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: PHP OpenSSL extension: Denial of Service...

RHEL 8 : php:7.4 (RHSA-2026:47750)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:47750 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: PHP OpenSSL extension: Denial of Service...

AlmaLinux 9 : php:8.3 (ALSA-2026:48197)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:48197 advisory. php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD CVE-2026-14355 Bug Fixes and Enhancements: Rebase PHP to 8.3.32 for...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: php (UTSA-2026-102686)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102686 advisory. Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versionsfrom 8.2. before 8.2.33, from 8.3. before 8.3.3...

ALSA-2026:56969 Important: php8.4 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

RHEL 9 : php:8.3 (RHSA-2026:48197)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:48197 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: PHP OpenSSL extension: Denial of Service...

AlmaLinux 8 : php:8.2 (ALSA-2026:47749)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:47749 advisory. php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD CVE-2026-14355 Bug Fixes and Enhancements: Rebase PHP to 8.2.32 for...

php8.4 security, bug fix, and enhancement update

8.4.24-2 - rebase to 8.4.24...

PT-2026-78299

Name of the Vulnerable Software and Affected Versions Broken Link Checker versions prior to 2.4.12 Description On sites using plain permalinks, the plugin fails to limit the query variables accepted from user input. This allows unauthenticated users to overwrite arbitrary PHP global variables and...