110647 matches found
CLEANSTART-2026-GO78577 In PHP versions 8
Security vulnerability affects the php package. In PHP versions 8...
CLEANSTART-2026-UW00601 In PHP version 8
Security vulnerability affects the php package. In PHP version 8...
CLEANSTART-2026-QY88672 In PHP versions 8
Security vulnerability affects the php package. In PHP versions 8...
CLEANSTART-2026-BM76577 Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings
CVE-2026-43871 affects multiple packages. Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings. See references for individual vulnerability details...
PT-2026-106753
Name of the Vulnerable Software and Affected Versions Kiota versions 0.5.0 through 1.34.1 Description Kiota is an OpenAPI based HTTP Client code generator. The Java and PHP documentation-comment sanitizers delete block-comment terminators instead of neutralizing them. This allows overlapping...
CVE-2026-104070: Missing Authorization
The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu anti-forgery parameter in crayonsstore.php, causing the authorization dispatcher to resolve an...
Rocky Linux 9.6 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1791281631)
The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791281631 advisory. - The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined...
PT-2026-106463
Unauthenticated PHP Object Injection in GDPR Framework By Data443 = 2.5.0 versions...
PT-2026-106761
HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport where an uploaded ZIP archive is extracted directly into the public web root before any validation of file names, extensions, or content is performed. An authenticated administrator can upload a crafte...
CVE-2026-105796: Improper Control of Generation of Code
Kiota is an OpenAPI based HTTP Client code generator. From 0.5.0 until 1.35.0, Kiota's Java and PHP documentation-comment sanitizers delete block-comment terminators rather than neutralizing them, allowing overlapping characters to reform a terminator and place attacker-controlled OpenAPI text...
PT-2026-106774
Name of the Vulnerable Software and Affected Versions Crayons plugin for SPIP versions prior to 3.5.0 Description A missing authorization flaw allows unauthenticated attackers to modify arbitrary editable object fields. This occurs when the secu anti-forgery parameter is omitted in the 'crayons...
CVE-2026-104747: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Haaken = 1.5 versions...
PT-2026-106380
Unauthenticated PHP Object Injection in Haaken = 1.5 versions...
CVE-2026-39797: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in GDPR Framework By Data443 = 2.5.0 versions...
Rocky Linux 9.6 [CIQ] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (ciqsa-2026_1587)
The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261587 advisory. This advisory aggregates security fixes for the php SRPM in CIQ LTS 9.6. It addresses 28 CVEs: CVE-2024-8925, CVE-2025-1217, CVE-2012-2386, CVE-2024-1123...
AlmaLinux 9.6 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1791281631)
The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791281631 advisory. - The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined...
PT-2026-106707
CVE-2026-103831: Insecure deserialization vulnerability in the Psr16CacheAdapter component of the TrueLayer Magento 2 Plugin, due to the use of PHP's native unserialize function without restrictions on the classes allowed when retrieving data stored in the cache. An attacker who already has the...
GHSA-8FXW-FMJ8-XP7J MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs
Impact Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...
MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs
Impact Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...
