110617 matches found
CLEANSTART-2026-UY82629 mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them
Security vulnerability affects the php package. The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them...
PT-2026-109207
Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...
CentOS Linux 8.4 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1791483256)
The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1791483256 advisory. - The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for...
PT-2026-108917
Name of the Vulnerable Software and Affected Versions Fuelthemes The Voux versions prior to 6.9.5 Description Fuelthemes The Voux contains an improper control of filename for include/require statement in PHP program, which allows for PHP Local File Inclusion. This occurs when the application fail...
PT-2026-109177
Stack-based Buffer Overflow, Integer Overflow or Wraparound vulnerability in Apache Thrift php bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...
CVE-2026-94067: Improper Control of Filename for Include/Require Statement in PHP Program
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Fuelthemes The Voux thevoux-wp allows PHP Local File Inclusion.This issue affects The Voux: from n/a through 6.9.5...
CVE-2025-15700: Unrestricted Upload of File with Dangerous Type
The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an uploaded ZIP archive during its listing-import feature, allowing users with the AWP Classifieds WordPress plugin before 4.4.9's management capability to upload arbitrary PHP files to a publicly...
CVE-2026-94062: Improper Control of Filename for Include/Require Statement in PHP Program
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Fuelthemes Werkstatt werkstatt allows PHP Local File Inclusion.This issue affects Werkstatt: from n/a through 4.8.3...
PT-2026-108903
Name of the Vulnerable Software and Affected Versions Fuelthemes Werkstatt versions prior to 4.8.3 Description Fuelthemes Werkstatt contains an improper control of filename for include/require statement in PHP program, which allows for PHP Local File Inclusion. This occurs when the application...
CVE-2024-25600-WordPress-Bricks-Builder-RCE-PoC
CVE-2024-25600 — WordPress Bricks Builder RCE PoC Unauthenticated remote code execution vulnerability in WordPress Bricks Builder id uid=33www-data gid=33www-data groups=33www-data References CVE-2024-25600 Bricks Builder Security Advisory Wordfence writeup Credits Discovery: Snicco / Calvin Alka...
DEBIAN-CVE-2026-106436
The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an invalid state. An unauthenticated actor who can cause an affected application to encode an unusually large data structure can terminate the...
CVE-2026-106436
The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an invalid state. An unauthenticated actor who can cause an affected application to encode an unusually large data structure can terminate the...
DEBIAN-CVE-2026-106432
The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size can wrap while the copy operation uses the original length. The resulting heap buffer overflow can corrupt proces...
CVE-2026-106432
The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size can wrap while the copy operation uses the original length. The resulting heap buffer overflow can corrupt proces...
CVE-2026-106436
The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an invalid state. An unauthenticated actor who can cause an affected application to encode an unusually large data structure can terminate the...
CVE-2026-106432
The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size can wrap while the copy operation uses the original length. The resulting heap buffer overflow can corrupt proces...
UBUNTU-CVE-2026-106432
The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size can wrap while the copy operation uses the original length. The resulting heap buffer overflow can corrupt proces...
UBUNTU-CVE-2026-106436
The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an invalid state. An unauthenticated actor who can cause an affected application to encode an unusually large data structure can terminate the...
