CVE-2026-75827: Improper Control of Generation of Code

Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the errorlog function through a data directive ...

PT-2026-76897

A weakness has been identified in PHPGurukul Complaint Management System 1.0. Affected by this issue is some unknown functionality of the file user/check availability.php. This manipulation of the argument email causes sql injection. Remote exploitation of the attack is possible. The exploit has...

EUVD-2026-61091

An incorrect access control vulnerability in reportico-web = 8.1.0 allows an unauthenticated attacker to inject arbitrary php code into the PreExecuteCode attribute of any report regardless of the safemode setting leading to remote code execution...

CVE-2026-73380: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Popup by Supsystic = 1.13.0 versions...

PT-2026-77132

Name of the Vulnerable Software and Affected Versions TaxoPress versions prior to 3.51.1 Description TaxoPress is subject to an object injection issue caused by the deserialization of untrusted data. This occurs when the application processes specially crafted serialized data, allowing an attacke...

CVE-2026-52608

An incorrect access control vulnerability in reportico-web = 8.1.0 allows an unauthenticated attacker to inject arbitrary php code into the PreExecuteCode attribute of any report regardless of the safemode setting leading to remote code execution...

CVE-2026-45117: Improper Control of Generation of Code

MyBB is free and open source forum software. From 1.8.13 until 1.8.40, the installer module does not properly escape user-supplied database configuration values written to the configuration file, resulting in PHP code injection and remote code execution when the installer is available...

CVE-2026-52607

The reportico-web software (version

CVE-2026-32470: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in FundEngine = 1.7.9 versions...

EUVD-2026-61097

A directory traversal vulnerability in reportico-web = 8.1.0 allows remote attackers to expose or execute arbitrary php files on the web server by specifying the filename in the targetformat parameter in conjunction with the executemode=EXECUTE parameter of the run.php endpoint...

PT-2026-77103

Unauthenticated Remote File Inclusion in Easy Google Maps 1.14.2 versions...

CVE-2026-73376: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic 1.5.0 versions...

Fedora 43 : php-phpseclib (2026-b2ce3f8e3e)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-b2ce3f8e3e advisory. Update to v2.0.55 - contains fix for CVE-2026-44167 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note th...

CVE-2026-52608

An incorrect access control vulnerability in reportico-web = 8.1.0 allows an unauthenticated attacker to inject arbitrary php code into the PreExecuteCode attribute of any report regardless of the safemode setting leading to remote code execution...

PT-2026-77117

Name of the Vulnerable Software and Affected Versions Youzify versions prior to 1.3.8 Description The software contains an unauthenticated deserialization flaw. This issue allows an attacker to process untrusted data without requiring authentication or user interaction, making it exploitable over...

PT-2026-77102

Unauthenticated PHP Object Injection in Easy Google Maps = 1.13.0 versions...

PT-2026-77086

Unauthenticated PHP Object Injection in RegistrationMagic = 6.0.9.7 versions...

CVE-2026-73366: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Easy Google Maps = 1.13.0 versions...

AlmaLinux 10 : php (ALSA-2026:48170)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:48170 advisory. php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD CVE-2026-14355 Bug Fixes and Enhancements: Rebase PHP to 8.3.32 for...

CVE-2026-75080

SourceCodester Class and Exam Timetabling System 1.0 contains a SQL injection vulnerability in the file /edit_subject1.php , triggered by manipulation of the ID parameter. The flaw allows remote, unauthenticated attackers to inject arbitrary SQL queries, potentially compromising confidentiality, ...