EUVD-2026-69922

Subscriber PHP Object Injection in WP User Frontend = 4.3.10 versions...

CLSA-2026-1788348158 TuxCare security update for firebase/php-jwt (1 CVE)

TuxCare rebuilt firebase/php-jwt to address 1 CVE. Fixed in v5.5.1-p1+tuxcare...

WordPress RTMKit plugin <= 2.1.5 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by daroo in WordPress Plugin RTMKit versions = 2.1.5...

RHSA-2026:62334 Red Hat Security Advisory: php:7.4 security, bug fix, and enhancement update

Bulletin has no description...

RHSA-2026:61903 Red Hat Security Advisory: php:8.2 security, bug fix, and enhancement update

Bulletin has no description...

CVE-2026-19116

The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing authenticated users with subscriber-level access and above to perform PHP Object Injection, which may lead ...

RLSA-2026:61903 Important: php:8.2 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archives CVE-2026-7260 Bug Fixes and Enhancements...

php:8.2 security, bug fix, and enhancement update

An update is available for php, module.php-pecl-rrd, php-pecl-apcu, module.php-pecl-apcu, php-pecl-zip, php-pecl-rrd, module.php, module.php-pecl-zip, php-pecl-xdebug3, module.php-pecl-xdebug3. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a...

php:7.4 security, bug fix, and enhancement update

An update is available for module.php-pecl-xdebug, module.libzip, php, module.php-pecl-rrd, php-pecl-apcu, module.php-pecl-apcu, libzip, php-pecl-zip, php-pecl-rrd, module.php, php-pecl-xdebug, php-pear, module.php-pear, module.php-pecl-zip. This update affects Rocky Linux 8. A Common Vulnerabili...

RLSA-2026:62334 Important: php:7.4 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archives CVE-2026-7260 Bug Fixes and Enhancements...

CVE-2026-19116 WP User Frontend < 4.3.11 - Subscriber+ PHP Object Injection via Frontend Post Edit Form

The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing authenticated users with subscriber-level access and above to perform PHP Object Injection, which may lead ...

EUVD-2026-69865

The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing authenticated users with subscriber-level access and above to perform PHP Object Injection, which may lead ...

CVE-2026-19116 WP User Frontend < 4.3.11 - Subscriber+ PHP Object Injection via Frontend Post Edit Form

The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing authenticated users with subscriber-level access and above to perform PHP Object Injection, which may lead ...

CVE-2026-19116

The User Frontend WordPress plugin before version 4.3.11 is vulnerable to PHP Object Injection because it fails to prevent the deserialization of user-supplied field values. This occurs when a submitted post is reopened within its frontend editing form. Attackers with subscriber-level access or h...

CVE-2026-84430

gouguoa versions up to 5.10.0/6.0.1 contain a vulnerability in the edit_personal Endpoint (file app/home/controller/Index.php, function update). Manipulation of the position_id argument leads to dynamically-determined object attributes , enabling remote exploitation. The exploit has been publicly...

EUVD-2026-69794

A security vulnerability has been detected in gouguoa up to 5.10.0/6.0.1. This vulnerability affects the function update of the file app/home/controller/Index.php of the component editpersonal Endpoint. Such manipulation of the argument positionid leads to dynamically-determined object attributes...

CVE-2026-81283: Deserialization of Untrusted Data

Subscriber PHP Object Injection in WP User Frontend = 4.3.10 versions...

PT-2026-84724

Name of the Vulnerable Software and Affected Versions Embed HTML5 Game WordPress plugin versions prior to 1.4 Description The plugin fails to properly restrict file upload permissions and the types of files that can be uploaded. This allows unauthenticated attackers to upload arbitrary files, suc...

PT-2026-84609

The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing authenticated users with subscriber-level access and above to perform PHP Object Injection, which may lead ...

CVE-2026-4357: Unrestricted Upload of File with Dangerous Type

The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files via the plugin, as well as what can be uploaded, making it possible for unauthenticated attackers to upload PHP backdoors on affected sites...