php: php: Access control bypass via partial IPv6 address comparison

A flaw was found in PHP. The access control check for Internet Protocol version 6 IPv6 addresses in the FastCGI implementation compares only the first 12 bytes of a 16-byte address instead of the complete address. An attacker on an adjacent network with an address sharing the first 96 bits with a...

php: php: Information disclosure via crafted TLS server certificate

A flaw was found in PHP. When validating secure connections using Transport Layer Security TLS, an error in how wildcard domain names in server certificates are verified can lead to an out-of-bounds memory read. A malicious server presenting a specially crafted certificate can exploit this issue...

php: php: Information disclosure via out-of-bounds read in stream filters

A flaw was found in PHP. When processing certain conversion stream filters with line-break settings containing a null byte, the filter duplicates the string but retains the original length rather than the truncated size. An attacker who can influence filter options could exploit this out-of-bound...

php: php: Denial of Service via out-of-bounds read in mysqlnd wire protocol parser

A flaw was found in PHP. The MySQL Native Driver mysqlnd wire protocol parser fails to verify that an incoming packet contains enough bytes before reading its fields. A malicious or compromised database server can send a truncated packet, causing the client application to read past the buffer...

php: PHP: Denial of Service via reserved device names on Windows

A flaw was found in PHP. When running on Windows environments, PHP's filesystem and stream handlers fail to reject reserved system device names in file paths. An attacker who can control file or stream paths can supply these reserved names to open system devices instead of standard files. This ca...

php: php: Credential disclosure via cross-origin HTTP redirects

A flaw was found in PHP. When following a redirect, the built-in HTTP Hypertext Transfer Protocol stream wrapper forwards sensitive request headers—such as authentication tokens and session cookies—unchanged, even when directed to a different host, port, or unencrypted connection. A malicious...

php: php: Denial of Service via unbounded recursion in SOAP parser

A flaw was found in PHP. An unauthenticated remote attacker could cause a Denial of Service DoS by sending a specially crafted request to an affected Simple Object Access Protocol SOAP server endpoint. Due to a lack of recursion depth limits when parsing deeply nested XML elements, processing suc...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: php: php-8.5.11-2.hum1 aarch64, x8664 php-bcmath-8.5.11-2.hum1 aarch64, x8664 php-cli-8.5.11-2.hum1 aarch64, x8664 php-common-8.5.11-2.hum1 aarch64, x8664 php-dba-8.5.11-2.hum1 aarch64, x8664...

WordPress Ninja Forms plugin 3.15.3 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Ninja Forms versions 3.15.3...

CVE-2026-75799

The YAHMAN Add-ons WordPress plugin before 0.9.31 does not validate the type of the remote files it caches in a publicly accessible directory, allowing unauthenticated attackers to write arbitrary PHP files on the server and achieve RCE when the relevant feature is enabled...

EUVD-2026-85024

The YAHMAN Add-ons WordPress plugin before 0.9.31 does not validate the type of the remote files it caches in a publicly accessible directory, allowing unauthenticated attackers to write arbitrary PHP files on the server and achieve RCE when the relevant feature is enabled...

Exploit for CVE-2026-87902

CVE-2026-87902-A-working-PoC-for-WordPress-s-critical-path-tra...

PT-2026-97518

Name of the Vulnerable Software and Affected Versions Sulu versions prior to 2.6.25 Sulu versions prior to 3.0.8 Description Sulu is an open-source PHP content management system based on the Symfony framework. A JCR-SQL2 injection exists in the Smart Content QueryBuilder within...

PT-2026-97491

Shop manager PHP Object Injection in Reycob Product Import Export = 2.3.0 versions...

PT-2026-97623

Name of the Vulnerable Software and Affected Versions SEMCMS versions prior to 4.3 Description A flaw exists in the KindEditor Upload Interface component within the file '/Edit/php/upload json.php'. Remote manipulation of the imgFile argument allows for cross-site scripting, a technique where...

CVE-2026-95603: Deserialization of Untrusted Data

Shop manager PHP Object Injection in Reycob Product Import Export = 2.3.0 versions...

PT-2026-97160

Name of the Vulnerable Software and Affected Versions YAHMAN Add-ons WordPress plugin versions prior to 0.9.31 Description The plugin fails to validate the type of remote files it caches within a publicly accessible directory. This allows unauthenticated attackers to write arbitrary PHP files to...

CVE-2026-63000: Cross-Site Request Forgery (CSRF)

REDAXO is a PHP-based content management system. Prior to 5.21.2, rexapiinstallpackageupdate in redaxo/src/addons/install/lib/api/apipackageupdate.php inherits the false default from rexapifunction::requiresCsrfProtection instead of requiring a CSRF token. An unauthenticated attacker can cause a...

WordPress 7.1.1 Local File Inclusion Scanner

WordPress versions 4.7.0 through 7.1.1 contain an unauthenticated page-template path traversal issue that can include readable local PHP files. This tool probes the wp-links-opml.php inclusion oracle without attempting command execution...

CVE-2026-75799: Improper Control of Generation of Code

The YAHMAN Add-ons WordPress plugin before 0.9.31 does not validate the type of the remote files it caches in a publicly accessible directory, allowing unauthenticated attackers to write arbitrary PHP files on the server and achieve RCE when the relevant feature is enabled...