CLSA-2026-1786609589 TuxCare security update for phenx/php-svg-lib (3 CVEs)

TuxCare rebuilt phenx/php-svg-lib to address 3 CVEs. Fixed in 0.4.1-p1+tuxcare...

CVE-2026-14182 Customer Email Verification for WooCommerce < 3.2.6 - Unauthenticated Account Takeover via Type-Juggling Authentication Bypass

The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the accoun...

CVE-2026-14355

A flaw was found in the OpenSSL extension of PHP. The AES-WRAP-PAD algorithm implementation uses the size of the plaintext length without accounting for the RFC 5649 expansion to allocate the output buffer for the AES key-wrap-with-padding operation. This may lead to an undersized memory allocati...

Exploit for CVE-2026-14282

CVE-2026-14282 — GoDAM WordPress Plugin RCE Author: null...

CVE-2026-46382

The Meeting Room Booking System MRBS is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, a user-supplied private/local URI can be made to be fetched without checks. Version 1.12.2 contains a fix. No known workarounds are available...

PT-2026-71579

Unauthenticated Local File Inclusion in Barista = 2.5.1 versions...

CVE-2026-28149: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Headless Single Sign On = 1.6 versions...

CVE-2026-46382: Server-Side Request Forgery (SSRF)

The Meeting Room Booking System MRBS is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, a user-supplied private/local URI can be made to be fetched without checks. Version 1.12.2 contains a fix. No known workarounds are available...

PT-2026-80143

TuxCare rebuilt phenx/php-svg-lib to address 3 CVEs. Fixed in 0.4.1-p1+tuxcare...

CVE-2026-73532: Embedded Malicious Code

Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file libs/class-license-sync.php, loaded via a requireonce directive added to fluentformpro.php,...

CVE-2026-28176: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...

CVE-2026-27380: Deserialization of Untrusted Data

Editor PHP Object Injection in Car Rental Manager = 1.3.9 versions...

PT-2026-71497

Editor PHP Object Injection in Car Rental Manager = 1.3.9 versions...

PT-2026-80149

TuxCare rebuilt webonyx/graphql-php to address 4 CVEs. Fixed in v14.11.10-p1+tuxcare...

PT-2026-71513

Unauthenticated PHP Object Injection in Headless Single Sign On = 1.6 versions...

CVE-2026-46688: URL Redirection to Untrusted Site

The Meeting Room Booking System MRBS is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, an unauthenticated request can be made to redirect the user to a query-specified location. This allows an attacker to create a specially-crafted URL to an MRBS installation that wil...

PT-2026-71525

Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...

PT-2026-71882

Name of the Vulnerable Software and Affected Versions FreePBX versions prior to 16.0.47 FreePBX versions prior to 17.0.30 Description The FreePBX Framework module allows an authenticated user with write access to backup files or sufficient backup-restore permissions to disable authentication. By...

CVE-2026-49827: Improper Input Validation

WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scanfile parameter, leading to Remote Code Execution. Combined with open registration no invite...

PT-2026-71486

Name of the Vulnerable Software and Affected Versions WebErpMesv2 versions prior to 1.20 Description WebErpMesv2 allows self-registered users to upload arbitrary PHP files via the scan file parameter in the HR Expense section, resulting in Remote Code Execution RCE. This is exacerbated by open...