CVE-2026-19116: Deserialization of Untrusted Data

The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing authenticated users with subscriber-level access and above to perform PHP Object Injection, which may lead ...

php:8.2 security, bug fix, and enhancement update

php 8.2.33-1 - rebase to 8.2.33 php-pecl-apcu 5.1.23-1 - update to 5.1.23 for PHP 8.2 RHEL-14699 php-pecl-rrd 2.0.3-4 - build for PHP 8.1 2070040 2.0.3-3 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz1991688 2.0.3-2 - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz1971065...

php:7.4 security, bug fix, and enhancement update

libzip 1.6.1-1 - update to 1.6.1 - enable lzma support php 7.4.33-6 - Fix leak on double DatePeriod::construct call - Fixed SQL injection via E'...' backslash breakout CVE-2026-17543 - Fixed GHSA-vc5h-9ppw-p5f3 Crash via recursive symlinks CVE-2026-7260 php-pear 1:1.10.13-1 - update PEAR to 1.10....

PT-2026-90680

TuxCare rebuilt firebase/php-jwt to address 1 CVE. Fixed in v5.5.1-p1+tuxcare...

PT-2026-84683

Subscriber PHP Object Injection in WP User Frontend = 4.3.10 versions...

CVE-2026-81772: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Ninja Forms - Layout & Styles = 3.0.31 versions...

PT-2026-84691

Name of the Vulnerable Software and Affected Versions Ninja Forms - Layout & Styles versions prior to 3.0.32 Description An unauthenticated PHP Object Injection exists in the plugin. PHP Object Injection is a vulnerability that occurs when untrusted input is passed to the PHP unserialize function...

PT-2026-84725

The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user-supplied PHP code, allowing any authenticated user, such as a subscriber, to run arbitrary code on the server...

CVE-2026-82524: Unrestricted Upload of File with Dangerous Type

UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated administrators to upload arbitrary PHP files through the TinyMCE image upload endpoint due to missing file extension and MIME type validation. Attackers can upload a PHP web shell to the public stora...

php security, bug fix, and enhancement update

8.3.33-1 - rebase to 8.3.33...

PT-2026-84863

Name of the Vulnerable Software and Affected Versions UnoPim versions prior to 2.1.5 Description Authenticated administrators can upload arbitrary PHP files through the TinyMCE image upload endpoint because the system fails to validate file extensions and MIME types. This allows an attacker to...

PT-2026-84708

The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is present on the blog...

AlmaLinux 8 : php:7.4 (ALSA-2026:62334)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:62334 advisory. php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archive...

RockyLinux 8 : php:7.4 (RLSA-2026:62334)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:62334 advisory. php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archiv...

CVE-2023-3360: Deserialization of Untrusted Data

The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is present on the blog...

ROS-20260902-73-0027

The vulnerability in PHP is related to overflow of buffers in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20260902-73-0026

The vulnerability in PHP is related to overflow of buffers in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20260902-73-0025

The vulnerability in PHP is related to overflow of buffers in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

snuffleupagus v0.14.0

Snuffleupagus Security module for php7 and php8 - Killing bugclasses and virtual-patching the rest! Key Features • Download • Examples • Documentation • License • Thanks Snuffleupagus is a PHP 7+ and 8+ module designed to drastically raise the cost of attacks against websites, by killing entire b...

php: ext-pgsql: PHP: SQL injection via improper backslash escaping

A flaw was found in PHP. Improper escaping of backslashes in attacker-provided parameters can lead to a SQL injection vulnerability. A remote attacker could exploit this flaw by crafting malicious input, potentially gaining unauthorized access to sensitive information, manipulating data, or causi...