CVE-2026-82667

This vulnerability affects yaojingang GEOFlow versions up to 2.1.0 . The server-side request forgery (SSRF) is triggered in the function DistributionController.isValidHttpEndpoint within app/Services/GeoFlow/GenericHttpEndpointResolver.php through manipulation of the endpoint_url argument. The at...

php: ext-pgsql: PHP: SQL injection via improper backslash escaping

A flaw was found in PHP. Improper escaping of backslashes in attacker-provided parameters can lead to a SQL injection vulnerability. A remote attacker could exploit this flaw by crafting malicious input, potentially gaining unauthorized access to sensitive information, manipulating data, or causi...

php: PHP: Denial of Service via circular symbolic links in phar archives

A flaw was found in PHP. When processing a specially crafted PHP Archive phar file containing circular symbolic links, the PHP process can enter an uncontrolled loop. This unbounded recursion exhausts the program's memory stack, causing the PHP application to crash. This vulnerability could allow...

php: ext/openssl: memory corruption in openssl_encrypt with AES-WRAP-PAD

A flaw was found in the OpenSSL extension of PHP. The AES-WRAP-PAD algorithm implementation uses the size of the plaintext length without accounting for the RFC 5649 expansion to allocate the output buffer for the AES key-wrap-with-padding operation. This may lead to an undersized memory allocati...

Low: Red Hat Security Advisory: php security, bug fix, and enhancement update

An update for php is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE lin...

CVE-2026-82226: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Tickera = 3.6.0.2 versions...

ROS-20260831-73-0021

The vulnerability in PHP is related to reading beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260831-73-0004

The vulnerability of the soapaddxmlref function in the PHP programming language is related to the possibility of using memory after it has been freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

CVE-2026-81889: Server-Side Request Forgery (SSRF)

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can bypass server-side request forgery protections when PHP cURL is unavailable because validateaddress validates $info'ip', but getremotecontent...

ALSA-2026:61259 Low: php security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext/openssl: memory corruption in opensslencrypt with AES-WRAP-PAD CVE-2026-14355 php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Servic...

PT-2026-84041

Name of the Vulnerable Software and Affected Versions Sulu versions prior to 2.6.25 Sulu versions prior to 3.0.8 Description An issue exists in the preview-link endpoint and the src/Sulu/Bundle/PreviewBundle/Application/Manager/PreviewLinkManager.php file where VIEW permissions are not enforced f...

ROS-20260831-73-0020

The vulnerability in PHP is related to reading beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-82395: Authorization Bypass Through User-Controlled Key

Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the media move endpoint derives its permission check from the client-supplied collection value instead of the media item's actual source collection, and...

ROS-20260831-73-0005

The vulnerability of the soapaddxmlref function in the PHP programming language is related to the possibility of using memory after it has been freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

ROS-20260831-73-0006

The vulnerability of the soapaddxmlref function in the PHP programming language is related to the possibility of using memory after it has been freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

ROS-20260831-73-0015

The vulnerability of the metaphone function ext/standard/metaphone.c in the PHP programming language is caused by a numerical overflow. Exploiting this vulnerability can allow an attacker to trigger segmentation errors and cause service failures...

Low: php security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext/openssl: memory corruption in opensslencrypt with AES-WRAP-PAD CVE-2026-14355 php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Servic...

ROS-20260831-73-0018

The vulnerability of the DOMNode::C14N method in the PHP programming language is related to the execution of a loop with an unreachable exit condition. Exploiting this vulnerability can allow an attacker to cause service failures remotely...

ROS-20260831-73-0017

The vulnerability of the DOMNode::C14N method in the PHP programming language is related to the execution of a loop with an unreachable exit condition. Exploiting this vulnerability can allow an attacker to cause service failures remotely...

CVE-2026-66047: Missing Authentication for Critical Function

ProfilePress wp-user-avatar WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to install and activate arbitrary plugins by brute-forcing a weak 32-bit connect token via the ppressconnectprocess AJAX handler...