CentOS Linux 8.4 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1785563367)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1785563367 advisory. - Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2...

CentOS Linux 6 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-devel / etc Multiple Vulnerabilities (CENTOS6:CLSA-2026:1777540774)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1777540774 advisory. - An issue was discovered in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8. An Integer Overflow...

CentOS Linux 6 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-devel / etc Multiple Vulnerabilities (CENTOS6:CLSA-2026:1779120876)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1779120876 advisory. - In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, and 8.5. before 8.5.6, the SOAP extension's object...

CentOS Linux 6 [TuxCare] Security Update: cups / cups-devel / cups-libs / cups-lpd / cups-php (CENTOS6:CLSA-2026:1785399587)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1785399587 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900...

SUSE CVE-2026-17545

On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW and opens a device instead of the...

CVE-2026-70356

The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web server...

CVE-2026-70356

The Toptech TMS7 and TopHAT systems are vulnerable to an unrestricted file upload flaw in the TMS file upload endpoint . Due to a lack of server-side file type restrictions , an attacker with high privileges can upload and execute arbitrary PHP files on the web server. This vulnerability has a CR...

CVE-2026-70356 Toptech TMS7 and TopHAT Unrestricted Upload of File with Dangerous Type

The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web server...

CVE-2026-70356 Toptech TMS7 and TopHAT Unrestricted Upload of File with Dangerous Type

The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web server...

CVE-2026-102425

Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms 2.4.3.4 - Balbooa Forms supports administrator-defined PHP code which runs after a public form submission. The feature also supports form-field shortcodes inside that PHP. Before calling eval, the...

EUVD-2026-89099

Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms 2.4.3.4 - Balbooa Forms supports administrator-defined PHP code which runs after a public form submission. The feature also supports form-field shortcodes inside that PHP. Before calling eval, the...

CVE-2026-102425 Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4

Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms 2.4.3.4 - Balbooa Forms supports administrator-defined PHP code which runs after a public form submission. The feature also supports form-field shortcodes inside that PHP. Before calling eval, the...

CVE-2026-102425

The Joomla Extension - balbooa.com is vulnerable to unauthenticated Remote Code Execution (RCE) in Balbooa Forms versions

CVE-2026-102425 Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4

Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms 2.4.3.4 - Balbooa Forms supports administrator-defined PHP code which runs after a public form submission. The feature also supports form-field shortcodes inside that PHP. Before calling eval, the...

DEBIAN-CVE-2026-102601

Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem across adapters calls pregmatch with the u modifier and treats both false and 0 as falsy. A path containing malformed UTF-8 causes...

UBUNTU-CVE-2026-102601

Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem across adapters calls pregmatch with the u modifier and treats both false and 0 as falsy. A path containing malformed UTF-8 causes...

OPENSUSE-SU-2026:21970-1 Security update for php-composer2

This update for php-composer2 fixes the following issues: - CVE-2026-59944: path traversal and link following issue can make files world readable and executable bsc1279898...

SUSE-SU-2026:23943-1 Security update for php-composer2

This update for php-composer2 fixes the following issues: - CVE-2026-59944: path traversal and link following issue can make files world readable and executable bsc1279898...

HUST-CSE-cybersecurity-practice-3

Comprehensive Cybersecurity Practice Three This repository co...

ILIAS <= 9.21 / 10.9 / 11.2 - PHP Object Injection RCE (CVE-2026-80428)

Unauthenticated PHP object injection in ILIAS via ltiauth.php session seeding and shiblogout.php SOAP LogoutNotification mass-unserialize. Chains GuzzleHttp\Cookie\FileCookieJar to write a webshell under the ILIAS docroot. Fixed in ILIAS 9.22 / 10.10 / 11.3. Packaged ILIAS 11.x shiblogout.php is...