110113 matches found
CVE-2014-9495
creationtimestamp| type| source ---|---|--- 2026-08-14 16:00:10+00:00| seen| https://t.me/purpsec/869 2026-08-15 00:00:12+00:00| published-proof-of-concept| https://t.me/purpsec/869...
Arbitrary Code Injection
Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Arbitrary Code Injection in the settings validation process of the Flex Objects plugin via uploading a ZIP archive containing PHP code. An...
CLSA-2026-1786712695 TuxCare security update for zendframework/zendframework1 (12 CVEs)
TuxCare rebuilt zendframework/zendframework1 to address 12 CVEs. Fixed in 1.11.0-p1+tuxcare...
CVE-2026-72819
Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead ...
CVE-2026-72819
Grav CMS prior to 2.0.13 is affected by a remote code execution via the Flex Objects plugin settings validation. Authenticated users can upload a ZIP containing PHP code, bypassing name validation with array notation, triggering unZip on a malicious archive and writing PHP files to the web root f...
CVE-2026-72819 Grav CMS before 2.0.13 Remote Code Execution via ZIP Upload
Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead ...
CVE-2026-72819
Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead ...
CVE-2026-72819 Grav CMS before 2.0.13 Remote Code Execution via ZIP Upload
Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead ...
WordPress Essential Real Estate plugin <= 5.3.3 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Steven Julian in WordPress Plugin Essential Real Estate versions = 5.3.3...
WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by daroo in WordPress Plugin FundEngine versions = 1.7.9...
RHSA-2026:48197 Red Hat Security Advisory: php:8.3 security, bug fix, and enhancement update
Bulletin has no description...
RHSA-2026:48170 Red Hat Security Advisory: php security, bug fix, and enhancement update
Bulletin has no description...
RHSA-2026:47750 Red Hat Security Advisory: php:7.4 security, bug fix, and enhancement update
Bulletin has no description...
RHSA-2026:47749 Red Hat Security Advisory: php:8.2 security, bug fix, and enhancement update
Bulletin has no description...
RHSA-2026:40416 Red Hat Security Advisory: php:8.2 security, bug fix, and enhancement update
Bulletin has no description...
GO-2022-1059 vulnerabilities
Vulnerabilities for packages: terraform-provider-sendgrid, dynamic-localpv-provisioner, gitleaks, hey, php-fpmexporter, grpcurl, vt-cli, kubeflow, k3d...
WordPress WooCommerce Subscriptions plugin < 9.1.0 - Unauthenticated RCE via PHP Object Injection vulnerability
Unauthenticated RCE via PHP Object Injection vulnerability discovered by Vasily Belolapotkov, Vlad Olaru in WordPress Plugin WooCommerce Subscriptions versions 9.1.0...
Client HttpTransport SSE buffer grows unbounded when server withholds the event delimiter
Summary The HTTP client transport in mcp/sdk reads a Server-Sent-Events SSE response stream incrementally and appends each 4 KiB chunk to an in-memory buffer $this-sseBuffer .= $chunk; with no upper bound. The buffer is only ever flushed when an SSE event delimiter "\n\n" appears. A remote MCP...
RLSA-2026:49914 Low: php8.4 security, bug fix, and enhancement update
PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...
RLSA-2026:48170 Low: php security, bug fix, and enhancement update
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD CVE-2026-14355 Bug Fixes and Enhancements: Rebase PHP to 8.3.32 for CVE-2026-14355 CVE-2026-12184 in...