RHEL 8 : php:8.2 (RHSA-2026:47749)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:47749 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: PHP OpenSSL extension: Denial of Service...

PT-2026-78941

Name of the Vulnerable Software and Affected Versions Shuffle versions 1.8 and earlier Description An unauthenticated Local File Inclusion issue exists, allowing an attacker to read arbitrary files from the local file system without requiring authentication. Recommendations Update Shuffle to a...

CVE-2026-75956: Allocation of Resources Without Limits or Throttling

Joomla Extension - cmsjunkie.com - DOS vector in pagination parameter handling in J-BusinessDirectory 6.2.3 - Pagination values were not strictly typed. Array/non-numeric values for example limitstart could trigger PHP type errors in arithmetic, and limit was not validated before use in list...

AlmaLinux 9 : php:8.3 (ALSA-2026:48197)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:48197 advisory. php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD CVE-2026-14355 Bug Fixes and Enhancements: Rebase PHP to 8.3.32 for...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: php (UTSA-2026-102686)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102686 advisory. Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versionsfrom 8.2. before 8.2.33, from 8.3. before 8.3.3...

RHEL 9 : php:8.2 (RHSA-2026:40416)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:40416 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: PHP OpenSSL extension: Denial of Service...

CVE-2026-62672: Inefficient Regular Expression Complexity

Grav is a file-based Web platform. Prior to 2.0.4, Grav allowlists the regexreplace filter and function in system/config/security.yaml, and GravExtension::regexReplace passes an editor-controlled pattern directly to pregreplace. When security.twigcontent.processenabled is enabled, an authenticate...

PT-2026-80667

Summary The documented Python and PHP output modes generate source-code snippets from caller-supplied SQL. Their output filters escape quote characters without first escaping existing backslashes. Crafted SQL can therefore neutralize the generated quote escape, terminate the intended language...

PT-2026-80737

Name of the Vulnerable Software and Affected Versions mcp/sdk versions 0.5.0 through 0.7.0 Description The HTTP client transport in the MCP PHP SDK reads a Server-Sent Events SSE response stream incrementally and appends data to an in-memory buffer sseBuffer without an upper bound. The buffer is...

PT-2026-78340

Customer PHP Object Injection in Flexible Subscriptions = 1.8.1 versions...

PT-2026-78346

Name of the Vulnerable Software and Affected Versions Kalles Addons versions prior to 1.0.7 Description An unauthenticated PHP Object Injection issue exists. PHP Object Injection occurs when untrusted input is passed to the unserialize function, allowing an attacker to manipulate serialized objec...

RHEL 8 : php:7.4 (RHSA-2026:47750)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:47750 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: PHP OpenSSL extension: Denial of Service...

PT-2026-78455

Joomla Extension - cmsjunkie.com - DOS vector in pagination parameter handling in J-BusinessDirectory 6.2.3 - Pagination values were not strictly typed. Array/non-numeric values for example limitstart could trigger PHP type errors in arithmetic, and limit was not validated before use in list...

CVE-2026-73389: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Kalles Addons = 1.0.6 versions...

CVE-2026-73364: Deserialization of Untrusted Data

Customer PHP Object Injection in Flexible Subscriptions = 1.8.1 versions...

ROS-20260819-73-0074

The vulnerability of the unserialize function in the MediaWiki software, which is used to implement the hypertext environment, is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

ALSA-2026:56969 Important: php8.4 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

php8.4 security, bug fix, and enhancement update

8.4.24-2 - rebase to 8.4.24...

EUVD-2026-36431

jmespath.php has CompilerRuntime code injection via unescaped function names...

GHSA-PCW8-M77R-2528 jmespath.php has CompilerRuntime code injection via unescaped function names

Impact mtdowling/jmespath.php can generate and execute attacker-controlled PHP code when JmesPath\CompilerRuntime is used with an attacker-controlled JMESPath expression. The compiler emits parsed JMESPath function names into generated PHP source without sufficient escaping. A crafted expression...