CVE-2026-96343: Deserialization of Untrusted Data

Custom role PHP Object Injection in WP ERP = 1.17.9 versions...

PT-2026-103188

Custom role PHP Object Injection in WP ERP = 1.17.9 versions...

CVE-2026-96344: Deserialization of Untrusted Data

Custom role PHP Object Injection in eCommerce Product Catalog = 3.6.0 versions...

CentOS Linux 7 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-devel / etc (CENTOS7:CLSA-2025:1753982448)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2025:1753982448 advisory. - In PHP versions:8.1. before 8.1.33, 8.2. before 8.2.29, 8.3. before 8.3.23, 8.4. pgsql and pdopgsql escaping functions do not check if the...

SUSE CVE-2026-17545

On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW and opens a device instead of the...

CVE-2026-70356

The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web server...

CVE-2026-70356 Toptech TMS7 and TopHAT Unrestricted Upload of File with Dangerous Type

The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web server...

CVE-2026-70356

The Toptech TMS7 and TopHAT systems are vulnerable to an unrestricted file upload flaw in the TMS file upload endpoint . Due to a lack of server-side file type restrictions , an attacker with high privileges can upload and execute arbitrary PHP files on the web server. This vulnerability has a CR...

CVE-2026-70356 Toptech TMS7 and TopHAT Unrestricted Upload of File with Dangerous Type

The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web server...

CVE-2026-102425

Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms 2.4.3.4 - Balbooa Forms supports administrator-defined PHP code which runs after a public form submission. The feature also supports form-field shortcodes inside that PHP. Before calling eval, the...

CVE-2026-102425 Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4

Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms 2.4.3.4 - Balbooa Forms supports administrator-defined PHP code which runs after a public form submission. The feature also supports form-field shortcodes inside that PHP. Before calling eval, the...

CVE-2026-102425 Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4

Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms 2.4.3.4 - Balbooa Forms supports administrator-defined PHP code which runs after a public form submission. The feature also supports form-field shortcodes inside that PHP. Before calling eval, the...

EUVD-2026-89099

Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms 2.4.3.4 - Balbooa Forms supports administrator-defined PHP code which runs after a public form submission. The feature also supports form-field shortcodes inside that PHP. Before calling eval, the...

CVE-2026-102425

The Joomla Extension - balbooa.com is vulnerable to unauthenticated Remote Code Execution (RCE) in Balbooa Forms versions

DEBIAN-CVE-2026-102601

Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem across adapters calls pregmatch with the u modifier and treats both false and 0 as falsy. A path containing malformed UTF-8 causes...

UBUNTU-CVE-2026-102601

Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem across adapters calls pregmatch with the u modifier and treats both false and 0 as falsy. A path containing malformed UTF-8 causes...

OPENSUSE-SU-2026:21970-1 Security update for php-composer2

This update for php-composer2 fixes the following issues: - CVE-2026-59944: path traversal and link following issue can make files world readable and executable bsc1279898...

SUSE-SU-2026:23943-1 Security update for php-composer2

This update for php-composer2 fixes the following issues: - CVE-2026-59944: path traversal and link following issue can make files world readable and executable bsc1279898...

HUST-CSE-cybersecurity-practice-3

Comprehensive Cybersecurity Practice Three This repository co...

WordPress Music Player for WooCommerce plugin <= 1.9.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Music Player for WooCommerce versions = 1.9.1...