CVE-2026-37603

Improper Restriction of Excessive Authentication Attempts in the administration login of pH7Software pH7Builder pH7 Social Dating CMS through 19.2.0. The CAPTCHA escalation flag is stored in the PHP session as captchaadminenabled and the CAPTCHA form element is only built when that flag is presen...

CVE-2026-37603

Improper Restriction of Excessive Authentication Attempts in the administration login of pH7Software pH7Builder pH7 Social Dating CMS through 19.2.0. The CAPTCHA escalation flag is stored in the PHP session as captchaadminenabled and the CAPTCHA form element is only built when that flag is presen...

CVE-2026-43642: Deserialization of Untrusted Data

Softaculous Virtualizor before 3.2.9 Patch 9 and 3.0.0 contains a PHP object injection vulnerability in the billing module handler that allows unauthenticated remote attackers to supply arbitrary serialized PHP objects for deserialization by setting the act parameter to login with the...

CVE-2026-95806: Deserialization of Untrusted Data

MISP ships with PHP's phar stream wrapper registered in both its web entry point and its console entry point. The phar stream wrapper causes PHP to treat a phar archive as a directory, which has two security consequences: - any filesystem operation on a caller-influenced path that resolves to a...

CVE-2026-95754: Improper Authorization

In MISP's UsersController login method, the pre-authentication database query used for the TOTP two-factor authentication verification branch did not include the User.disabled column in its SELECT fields list. The query selected only User.password, User.totp, and User.hotpcounter. When the TOTP...

CVE-2026-95499: Unrestricted Upload of File with Dangerous Type

A flaw has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. This issue affects the function moveuploadedfile of the file filemanager.php. Executing a manipulation of the argument files can lead to unrestricted upload. The attack can be executed remotely. The vendor was...

CVE-2026-9231: Improper Control of Filename for Include/Require Statement in PHP Program

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.8.0 via the wtegettemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, ...

CVE-2026-19658: Deserialization of Untrusted Data

The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.1 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software,...

PT-2026-96784

In MISP's UsersController login method, the pre-authentication database query used for the TOTP two-factor authentication verification branch did not include the User.disabled column in its SELECT fields list. The query selected only User.password, User.totp, and User.hotp counter. When the TOTP...

PT-2026-97033

Name of the Vulnerable Software and Affected Versions WuzhiCMS version 5.0.0 Description An unrestricted file upload issue exists in the thumbnail-upload endpoint '/index.php?m=member&f=article&v=thumbUpload'. An authenticated low-privileged member can upload a crafted .php file to execute...

PT-2026-96727

Name of the Vulnerable Software and Affected Versions php-file-manager-with-code-editor versions prior to 3.1 Description A flaw in the move uploaded file function within the filemanager.php file allows for unrestricted file upload. This issue can be exploited remotely by manipulating the files...

PT-2026-96763

Name of the Vulnerable Software and Affected Versions php-file-manager-with-code-editor versions prior to 3.1 Description An unrestricted file upload issue exists in the Save Handler component. A remote attacker can manipulate the filename and content arguments within the file put contents functi...

PT-2026-96645

Name of the Vulnerable Software and Affected Versions Give Tributes versions prior to 2.3.2 Description The Give Tributes plugin for WordPress is susceptible to PHP Object Injection through the deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP Object. The...

PT-2026-96677

Name of the Vulnerable Software and Affected Versions HUSKY – Products Filter for WooCommerce Professional versions prior to 1.4.5 Description The plugin is subject to Local File Inclusion, a condition where an application includes files from the local file system without proper validation...

PT-2026-96921

Name of the Vulnerable Software and Affected Versions Softaculous Virtualizor versions prior to 3.2.9 Patch 9 Softaculous Virtualizor version 3.0.0 Description A PHP object injection issue exists in the billing module handler. Unauthenticated remote attackers can provide arbitrary serialized PHP...

PT-2026-96651

Name of the Vulnerable Software and Affected Versions Ninja Forms WordPress plugin version 3.15.3 Description An issue exists where user-submitted form field values are not prevented from being deserialized when an administrator exports form submissions to CSV. This allows unauthenticated attacke...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: php (UTSA-2026-054028)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-054028 advisory. In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdomysql extension with mysqlnd driver, if the third party is allowed to supply...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: php (UTSA-2026-090650)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090650 advisory. In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTERVALIDATEFLOAT filter and min/max limits, if the...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: php (UTSA-2026-090110)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090110 advisory. In PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21 and 7.4.x below 7.4.9, while processing PHAR files using phar extension, pharparsezipfile could be tricked int...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: php (UTSA-2023-002406)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002406 advisory. In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function allocate buffer one byte too small. When resolving paths with...