EUVD-2026-58633

Grav CMS vulnerable to remote code execution via .zip file upload...

100,000 WordPress Sites Exposed to Remote Code Execution via PHP Object Injection Vulnerability Found by Wordfence Argus in Tutor LMS

On August 23rd, 2026, Wordfence Argus, our AI research agent specializing in complex vulnerability chains, discovered a PHP Object Injection vulnerability in Tutor LMS, a WordPress e-learning plugin active on more than 100,000 websites. This vulnerability allows any authenticated attacker with...

EUVD-2026-82421

Wavelog is web-based amateur radio logging software. From 1.8 until 2.4.2, Wavelog exposes /install/ajax.php and /install/includes/interfaceassets/triggers.php after installation without an installation lock or permission check. Unsanitized input reaches writeconfig and writeconfigfile in...

CVE-2026-54237 Wavelog: Unauthenticated Remote Code Execution

Wavelog is web-based amateur radio logging software. From 1.8 until 2.4.2, Wavelog exposes /install/ajax.php and /install/includes/interfaceassets/triggers.php after installation without an installation lock or permission check. Unsanitized input reaches writeconfig and writeconfigfile in...

CVE-2026-54237 Wavelog: Unauthenticated Remote Code Execution

Wavelog is web-based amateur radio logging software. From 1.8 until 2.4.2, Wavelog exposes /install/ajax.php and /install/includes/interfaceassets/triggers.php after installation without an installation lock or permission check. Unsanitized input reaches writeconfig and writeconfigfile in...

EUVD-2026-82416

The Datadog PHP Tracer provides application performance monitoring and distributed tracing for PHP. Prior to 1.19.2, ddtracedeserializebaggage in ext/distributedtracingheaders.c parses incoming W3C baggage HTTP headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES. A remote...

CVE-2026-50275 Datadog PHP Tracer: Improper parsing of W3C baggage headers may lead to DoS

The Datadog PHP Tracer provides application performance monitoring and distributed tracing for PHP. Prior to 1.19.2, ddtracedeserializebaggage in ext/distributedtracingheaders.c parses incoming W3C baggage HTTP headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES. A remote...

CVE-2026-50275

Datadog PHP Tracer prior to 1.19.2 contains a denial-of-service vulnerability in ddtrace_deserialize_baggage (ext/distributed_tracing_headers.c). The function parses incoming W3C baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES, allowing a remote una...

CVE-2026-50275 Datadog PHP Tracer: Improper parsing of W3C baggage headers may lead to DoS

The Datadog PHP Tracer provides application performance monitoring and distributed tracing for PHP. Prior to 1.19.2, ddtracedeserializebaggage in ext/distributedtracingheaders.c parses incoming W3C baggage HTTP headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES. A remote...

CVE-2026-50275 Datadog PHP Tracer: Improper parsing of W3C baggage headers may lead to DoS

The Datadog PHP Tracer provides application performance monitoring and distributed tracing for PHP. Prior to 1.19.2, ddtracedeserializebaggage in ext/distributedtracingheaders.c parses incoming W3C baggage HTTP headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES. A remote...

CVE-2026-79752 CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection

CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit valu...

EUVD-2026-81673

CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit valu...

CVE-2026-79752 CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection

CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit valu...

WordPress ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin <= 6.5.5 - Authenticated (Author+) PHP Object Injection vulnerability

Authenticated Author+ PHP Object Injection vulnerability discovered by Josh Bolding in WordPress Plugin ShortPixel Image Optimizer versions = 6.5.5...

exploit_proftpd

Explotacion de una vulnerabilidad de ProFTPD para conseguir ej...

php:php-fuzz-unserialize: Use-of-uninitialized-value in zim_Time_Duration___unserialize

Detailed Report: https://oss-fuzz.com/testcase?key=6431772334948352 Project: php Fuzzing Engine: libFuzzer Fuzz Target: php-fuzz-unserialize Job Type: libfuzzermsanphp Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: zimTimeDurationunserialize zendcallfunction...

[SECURITY] Fedora 43 Update: php-pecl-mongodb2-2.1.9-1.fc43

The purpose of this driver is to provide exceptionally thin glue between MongoDB and PHP, implementing only fundemental and performance-critical components necessary to build a fully-functional MongoDB driver...

[SECURITY] Fedora 44 Update: php-pecl-mongodb2-2.1.9-1.fc44

The purpose of this driver is to provide exceptionally thin glue between MongoDB and PHP, implementing only fundemental and performance-critical components necessary to build a fully-functional MongoDB driver...

[SECURITY] Fedora 45 Update: roundcubemail-1.7.4-1.fc45

RoundCube Webmail is a browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an e-mail client, including MIME support, address book, folder manipulation, message searching and spell checking. RoundCube Webmail is written in...

CVE-2026-50275: Allocation of Resources Without Limits or Throttling

The Datadog PHP Tracer provides application performance monitoring and distributed tracing for PHP. Prior to 1.19.2, ddtracedeserializebaggage in ext/distributedtracingheaders.c parses incoming W3C baggage HTTP headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES. A remote...