CVE-2026-17543

Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9...

CVE-2026-17543 SQL injection in ext-pgsql via E'...' backslash breakout

Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9...

CVE-2026-17543

Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9...

CVE-2026-17543

Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9...

CVE-2026-17543

CVE-2026-17543 affects PHP with ext-pgsql, where improper escaping of backslashes in attacker-provided parameters enables SQL injection via E'...' backslash breakout. Vulnerable PHP versions: 8.2.x before 8.2.33, 8.3.x before 8.3.33, 8.4.x before 8.4.24, and 8.5.x before 8.5.9. Affected component...

CVE-2026-14602 Remote API <= 0.2 - Unauthenticated PHP Object Injection via remote-api Query Parameter

The Remote API WordPress plugin through 0.2 does not authenticate a request before deserializing user-supplied input, allowing unauthenticated attackers to inject arbitrary PHP objects, which can lead to remote code execution when a suitable gadget chain is present through another installed Remot...

CVE-2026-1360 BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data

The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 14.5.0 This is due to the bpunserializeprofilefield function using @unserialize without the allowedclasses parameter on user-controlled XProfile field data. This makes it...

CVE-2026-1360

BuddyPress for WordPress up to 14.5.0 is affected by a Deserialization of Untrusted Data flaw in bp_unserialize_profile_field(), which calls unserialize() without the allowed_classes parameter on user-controlled XProfile field data. This allows an authenticated attacker (subscriber level or highe...

CVE-2026-16610

CVE-2026-16610 , for the Admin and Site Enhancements (ASE) Pro WordPress plugin, is documented as allowing unauthenticated remote code execution in all versions up to 8.9.0 via the recursive_html function. The root cause is a vulnerable frontend save handler that relies on a publicly emitted nonc...

CVE-2026-16610 Admin and Site Enhancements (ASE) Pro <= 8.9.0 - Unauthenticated Remote Code Execution via PHP Code Injection via cfgroup[input] Repeater Row Key

The Admin and Site Enhancements ASE Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.9.0 via the recursivehtml function. This is due to the frontend save handler enforces only a publicly emitted nonce with no authentication check, CAPTCHA...

Linux Distros Unpatched Vulnerability : CVE-2026-7260

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2. befor...

EUVD-2026-51328

An issue in dnsmgr v.2.15 and before allows a local attacker to execute arbitrary code via the ping function of the CheckUils.php file...

PT-2026-66458

Name of the Vulnerable Software and Affected Versions PHP versions 8.4.0 through 8.4.23 PHP versions 8.5.0 through 8.5.8 Description Attacker-provided inputs to the bccomp function can lead to an out-of-bounds write, resulting in stack and heap corruption. An out-of-bounds write occurs when a...

vim security update

9.1.083-9.0.1.el102.12 - Remove upstream references Orabug: 31197557 2:9.1.083-9.12 - RHEL-201113 CVE-2026-59856 vim: potential command execution in PHP omni-completion 2:9.1.083-9.11 - RHEL-203857 CVE-2026-59858 vim: arbitrary Ex command execution during C omni-completion 2:9.1.083-9.10 -...

PT-2026-66463

Name of the Vulnerable Software and Affected Versions PHP versions 8.2.0 through 8.2.32 PHP versions 8.3.0 through 8.3.32 PHP versions 8.4.0 through 8.4.23 PHP versions 8.5.0 through 8.5.8 Description Circular symbolic links in phar archives can cause unbounded recursion, which exhausts the C sta...

Linux Distros Unpatched Vulnerability : CVE-2026-17544

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Attacker-provided inputs to bccomp could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4. before 8.4.24 and from 8.5...

Linux Distros Unpatched Vulnerability : CVE-2026-17543

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before...

PHP 8.3.x < 8.3.33 Multiple Vulnerabilities SQLI

The version of PHP installed on the remote host is prior to 8.3.33. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.3.33 advisory. - Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8....

PT-2026-66457

Name of the Vulnerable Software and Affected Versions PHP versions 8.2.0 through 8.2.32 PHP versions 8.3.0 through 8.3.32 PHP versions 8.4.0 through 8.4.23 PHP versions 8.5.0 through 8.5.8 Description Improper escaping of backslashes in attacker-provided parameters allows for SQL injection, a...

PHP 8.2.x < 8.2.33 Multiple Vulnerabilities SQLI

The version of PHP installed on the remote host is prior to 8.2.33. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.2.33 advisory. - Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8....