WordPress ElementsKit Elementor Addons plugin < 3.10.01 - Subsite Administrator+ PHP Code Injection vulnerability

Subsite Administrator+ PHP Code Injection vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin ElementsKit Elementor addons Lite versions 3.10.01...

CVE-2026-16618

The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the attacker-supplied extension into a publicly accessible directory, allowing unauthenticated users to upload executable PHP files and achiev...

WordPress Kirki plugin < 6.0.13 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Hermanhms in WordPress Plugin Kirki versions 6.0.13...

CVE-2026-16623 Create Block Theme < 2.10.0 - Admin+ PHP Code Injection via Pattern Save (Multisite)

The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a multisite subsite administrator who holds the capability gating this action but is denied the capability that normally gates PHP file editin...

CVE-2026-16618 ImproveSEO <= 2.0.11 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution

The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the attacker-supplied extension into a publicly accessible directory, allowing unauthenticated users to upload executable PHP files and achiev...

EUVD-2026-52579

The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a multisite subsite administrator who holds the capability gating this action but is denied the capability that normally gates PHP file editin...

CVE-2026-16623

The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a multisite subsite administrator who holds the capability gating this action but is denied the capability that normally gates PHP file editin...

Exploit for Incorrect Default Permissions in Samsung Android

--- CVE-2026-21015 – PHP Filter Chain Arbitrary File Read...

PT-2026-67717

Name of the Vulnerable Software and Affected Versions chetans9 core-php-admin-panel versions up to 90d07ed5aac5e0f09b6a5828d7bb2eb83010763f Description A flaw in the processing of the file /Applications/MAMP/htdocs/core-php-admin-panel-master/customers.php allows for a remote attack. By...

PT-2026-67632

A flaw has been found in kalcaddle kodbox 1.67 Build 02. This vulnerability affects unknown code of the file /index.php?plugin/msgWarning/action of the component msgWarning Plugin. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The explo...

PT-2026-67667

The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a multisite subsite administrator who holds the capability gating this action but is denied the capability that normally gates PHP file editin...

PT-2026-74931

TuxCare rebuilt aws/aws-sdk-php to address 1 CVE. Fixed in 3.263.4-p2+tuxcare...

PT-2026-73725

TuxCare rebuilt aws/aws-sdk-php to address 1 CVE. Fixed in 3.263.4-p1+tuxcare...

CVE-2026-16623: Improper Control of Generation of Code

The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a multisite subsite administrator who holds the capability gating this action but is denied the capability that normally gates PHP file editin...

Critical: php

Issue Overview: Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9. CVE-2026-17543 Circular symbolic links in phar archives cou...

Amazon Linux 2 : php, --advisory ALAS2PHP8.2-2026-013 (ALASPHP8.2-2026-013)

The version of php installed on the remote host is prior to 8.2.33-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2PHP8.2-2026-013 advisory. Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions...

PT-2026-73721

TuxCare rebuilt firebase/php-jwt to address 1 CVE. Fixed in 6.11.1-p2+tuxcare...

PT-2026-68506

Name of the Vulnerable Software and Affected Versions Ajax Search Lite versions prior to 4.14.5 Description The Ajax Search Lite – Live Search & Filter plugin for WordPress allows unauthenticated attackers to perform PHP Object Injection through the deserialization of untrusted input. PHP Object...

PT-2026-75382

TuxCare rebuilt aws/aws-sdk-php to address 1 CVE. Fixed in 3.263.4-p3+tuxcare...

Critical: php8.5

Issue Overview: Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9. CVE-2026-17543 Attacker-provided inputs to bccomp could lea...