CLSA-2026-1786712695 TuxCare security update for zendframework/zendframework1 (12 CVEs)

TuxCare rebuilt zendframework/zendframework1 to address 12 CVEs. Fixed in 1.11.0-p1+tuxcare...

CVE-2026-72819

Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead ...

CVE-2026-72819

Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead ...

CVE-2026-72819

Grav CMS prior to 2.0.13 is affected by a remote code execution via the Flex Objects plugin settings validation. Authenticated users can upload a ZIP containing PHP code, bypassing name validation with array notation, triggering unZip on a malicious archive and writing PHP files to the web root f...

CVE-2026-72819

Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead ...

CVE-2026-72819 Grav CMS before 2.0.13 Remote Code Execution via ZIP Upload

Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead ...

CVE-2026-72819 Grav CMS before 2.0.13 Remote Code Execution via ZIP Upload

Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead ...

WordPress Essential Real Estate plugin <= 5.3.3 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Steven Julian in WordPress Plugin Essential Real Estate versions = 5.3.3...

WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by daroo in WordPress Plugin FundEngine versions = 1.7.9...

RHSA-2026:48197 Red Hat Security Advisory: php:8.3 security, bug fix, and enhancement update

Bulletin has no description...

RHSA-2026:48170 Red Hat Security Advisory: php security, bug fix, and enhancement update

Bulletin has no description...

RHSA-2026:47750 Red Hat Security Advisory: php:7.4 security, bug fix, and enhancement update

Bulletin has no description...

RHSA-2026:47749 Red Hat Security Advisory: php:8.2 security, bug fix, and enhancement update

Bulletin has no description...

RHSA-2026:40416 Red Hat Security Advisory: php:8.2 security, bug fix, and enhancement update

Bulletin has no description...

GO-2022-1059 vulnerabilities

Vulnerabilities for packages: kubeflow, terraform-provider-sendgrid, hey, dynamic-localpv-provisioner, gitleaks, grpcurl, k3d, php-fpmexporter, vt-cli...

WordPress WooCommerce Subscriptions plugin < 9.1.0 - Unauthenticated RCE via PHP Object Injection vulnerability

Unauthenticated RCE via PHP Object Injection vulnerability discovered by Vasily Belolapotkov, Vlad Olaru in WordPress Plugin WooCommerce Subscriptions versions 9.1.0...

Client HttpTransport SSE buffer grows unbounded when server withholds the event delimiter

Summary The HTTP client transport in mcp/sdk reads a Server-Sent-Events SSE response stream incrementally and appends each 4 KiB chunk to an in-memory buffer $this-sseBuffer .= $chunk; with no upper bound. The buffer is only ever flushed when an SSE event delimiter "\n\n" appears. A remote MCP...

RLSA-2026:49914 Low: php8.4 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

RLSA-2026:48170 Low: php security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD CVE-2026-14355 Bug Fixes and Enhancements: Rebase PHP to 8.3.32 for CVE-2026-14355 CVE-2026-12184 in...

php security, bug fix, and enhancement update

An update is available for php. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list PHP is an HTML-embedded scripting language commonly used with the Apache HTTP...