WordPress Turnkey bbPress by WeaverTheme plugin <= 1.7.1 - Authenticated (Administrator+) PHP Object Injection vulnerability

Authenticated Administrator+ PHP Object Injection vulnerability discovered by Luk6785 in WordPress Plugin Turnkey bbPress versions = 1.7.1...

WordPress RegistrationMagic plugin <= 6.0.9.7 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by dutafi in WordPress Plugin RegistrationMagic versions = 6.0.9.7...

WordPress Popup by Supsystic plugin <= 1.13.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Asim Alshaya in WordPress Plugin Popup by Supsystic versions = 1.13.0...

WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Asim Alshaya in WordPress Plugin Ultimate Maps by Supsystic versions 1.5.0...

WordPress Podlove Podcast Publisher plugin <= 4.5.3 - Authenticated (Contributor+) PHP Object Injection to Arbitrary File Deletion via 'unfurl_data' Parameter vulnerability

Authenticated Contributor+ PHP Object Injection to Arbitrary File Deletion via 'unfurldata' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Podlove Podcast Publisher versions = 4.5.3...

CLSA-2026-1787038633 TuxCare security update for zendframework/zendframework1 (10 CVEs)

TuxCare rebuilt zendframework/zendframework1 to address 10 CVEs. Fixed in 1.11.0-p2+tuxcare...

K000162967: PHP vulnerability CVE-2026-17544

Security Advisory Description Attacker-provided inputs to bccomp could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4. before 8.4.24 and from 8.5. before 8.5.9. CVE-2026-17544 Impact There is no impact; F5 products are not affected by this vulnerability...

Exploit for CVE-2024-40275

CVE-2024-40725 Scanner A Python-based detection tool for CV...

[SECURITY] Fedora 43 Update: php-phpseclib-2.0.55-1.fc43

MIT-licensed pure-PHP implementations of an arbitrary-precision integer arithmetic library, fully PKCS1 v2.1 compliant RSA, DES, 3DES, RC4, Rijndael, AES, Blowfish, Twofish, SSH-1, SSH-2, SFTP, and X.509...

EUVD-2026-60472

A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /BSCE2.php. Such manipulation of the argument course leads to cross site scripting. The attack may be launched remotely. The exploit is publicly...

EUVD-2026-60556

A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. This vulnerability affects unknown code of the file /editsubject2.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been made...

EUVD-2026-60557

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. This issue affects some unknown processing of the file /editsubject1.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit...

EUVD-2026-60555

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /BSHRM1.php. Performing a manipulation of the argument course results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been...

CVE-2026-75080

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. This issue affects some unknown processing of the file /editsubject1.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit...

CVE-2026-75079

A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. This vulnerability affects unknown code of the file /editsubject2.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been made...

CVE-2026-32465: Deserialization of Untrusted Data

Customer PHP Object Injection in Essential Real Estate = 5.3.3 versions...

CVE-2026-52608

The software reportico-web (version

PT-2026-77231

Name of the Vulnerable Software and Affected Versions reportico-web versions prior to 8.1.1 Description A directory traversal issue allows remote attackers to expose or execute arbitrary PHP files on the web server. This occurs when a filename is specified in the target format parameter while usi...

PT-2026-77117

Name of the Vulnerable Software and Affected Versions Youzify versions prior to 1.3.8 Description The software contains an unauthenticated deserialization flaw. This issue allows an attacker to process untrusted data without requiring authentication or user interaction, making it exploitable over...

CVE-2026-75827: Improper Control of Generation of Code

Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the errorlog function through a data directive ...