CVE-2026-78276: Deserialization of Untrusted Data

Editor PHP Object Injection in Fluent Boards Pro = 2.0.11 versions...

CVE-2026-78257: Deserialization of Untrusted Data

Contributor PHP Object Injection in Booking and Rental Manager = 2.7.5 versions...

CVE-2026-37069: Exposure of Sensitive Information to an Unauthorized Actor

Absolute Path Disclosure in /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to know in which system directory the application code is running by sending a GET request to the endpoint...

PT-2026-82671

Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected endpoint...

PT-2026-82465

Unauthenticated PHP Object Injection in Hash Form = 1.4.1 versions...

e-SIC Livre 0.2.2 Resource Consumption

e-SIC Livre versions 0.2.2 and below suffer from a resource consumption vulnerability in the CAPTCHA generation component. CVE-2026-50787 — Uncontrolled Resource Consumption in e-SIC Livre Summary A resource consumption vulnerability exists in the CAPTCHA generation component of e-SIC Livre...

PT-2026-82538

Name of the Vulnerable Software and Affected Versions Volmarg Personal Management System affected versions not specified Description Authenticated attackers can read arbitrary files by providing absolute filesystem paths to the 'GET /public/get-file/path' endpoint. This occurs because the path...

CVE-2026-19092: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output...

PT-2026-82451

Name of the Vulnerable Software and Affected Versions Booking and Rental Manager versions prior to 2.7.6 Description An issue exists that allows for PHP Object Injection, a technique where an attacker leverages the deserialization of untrusted data to instantiate arbitrary objects and execute...

PT-2026-82462

Unauthenticated PHP Object Injection in Geo Controller = 8.9.8 versions...

CVE-2026-78292: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Hash Form = 1.4.1 versions...

EUVD-2026-67262

Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected endpoint...

PT-2026-82426

Name of the Vulnerable Software and Affected Versions Joomla Event Manager versions prior to 5.0.1 Description An issue in the administrator source model allows the upload of dangerous file types, including PHP files, which can lead to privileged remote code execution. Recommendations Update Joom...

CVE-2026-78286: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Geo Controller = 8.9.8 versions...

CVE-2026-37068

The Veno File Manager Project 4.4.9 is vulnerable to an arbitrary file write flaw within the /vfm-admin/index.php?section=translations&action=update endpoint. This issue allows an authenticated user with super administrator privileges to overwrite any PHP file within the application by sending a ...

CVE-2026-37068

Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected endpoint...

CVE-2026-37068

Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected endpoint...

CVE-2026-77991: Unrestricted Upload of File with Dangerous Type

Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager 5.0.1 - The administrator source model allows to write dangerous file type incl. PHP, leading to remote code execution...

CVE-2026-54718: Improper Neutralization of Special Elements Used in a Template Engine

Silverstripe Advanced Workflow is a highly configurable step-based workflow module. Prior to 6.4.5, 7.1.3, and 7.2.1, an attacker with permission to author the advanced workflow email template can place a specially crafted server-side template payload in NotifyUsersWorkflowAction.EmailTemplate...

PT-2026-84464

Name of the Vulnerable Software and Affected Versions Composer versions 1.0 through 2.2.29 Composer versions 2.10.0 through 2.10.2 Description Composer, a dependency manager for PHP, fails to validate the source.url when source.type is set to perforce. A malicious package from a custom repository...