CVE-2026-35048: Improper Input Validation

The Piwigo installer in versions 16.3.0 and earlier accepts POST parameters for database configuration and writes them directly into a PHP configuration file without proper sanitization. On PHP 8+, the addslashes protection is bypassed because it checks for getmagicquotesgpc, a function removed i...

Medium: php8.3

Issue Overview: PHP: Failure to setup TLS with a remote server can result in a remote DoS CVE-2026-12184 PHP: ext/openssl: Memory corruption zendmmheap corrupted in opensslencrypt with AES-WRAP-PAD CVE-2026-14355 Affected Packages: php8.3 Issue Correction: Run dnf update php8.3 --releasever...

Amazon Linux 2023 : php8.2, php8.2-bcmath, php8.2-cli (ALAS2023-2026-1958)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1958 advisory. PHP: ext/openssl: Memory corruption zendmmheap corrupted in opensslencrypt with AES-WRAP-PAD CVE-2026-14355 Tenable has extracted the preceding description block directly from the tested product securi...

Oracle Linux 9 : php:8.2 (ELSA-2026-40416)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-40416 advisory. php 8.2.32-1 - rebase to 8.2.32 php-pecl-apcu 5.1.23-1 - update to 5.1.23 for PHP 8.2 RHEL-14699 php-pecl-rrd 2.0.3-4 - build for PHP 8.1 2070040 2.0.3-3 -...

CVE-2026-60026: Improper Control of Generation of Code

Joomla Extension - themexpert.com - Authenticated PHP code execution in Quix Page Builder 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated PHP code execution. Authenticated builder user core.create/core.edit could inject PHP tags in element content, that got...

CVE-2026-51027: Exposure of Sensitive Information to an Unauthorized Actor

An issue in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via the ft2.php component...

CVE-2026-51027

An issue in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via the ft2.php component...

Oracle Linux 10 : php8.4 (ELSA-2026-22649)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-22649 advisory. 8.4.21-2 - rebase to 8.4.21 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus...

CVE-2026-53594: Improper Limitation of a Pathname to a Restricted Directory

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. FreeScout's Manage - Logs - App Logs feature uses the bundled rap2hpoutre/laravel-log-viewer override to decrypt a user-supplied file identifier and then pass the resolved path to Laravel's download response. Prior...

CVE-2026-45295: Authorization Bypass Through User-Controlled Key

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.219, the open tracking endpoint GET /thread/read/conversationid/threadid allows unauthenticated attackers to enumerate valid conversation and thread IDs, and modify thread state openedat...

CVE-2026-57311: Unrestricted Upload of File with Dangerous Type

Windu CMS does not validate types of uploaded files. An authenticated attacker can upload arbitrary files, including PHP. This can lead to Remote Code Execution. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other...

CVE-2026-51027

CVE-2026-51027 affects FileThingie v2.5.7, where the ft2.php component allows a remote attacker to obtain sensitive information. The issue is documented in multiple sources (NVD/CVE records) with a high impact and CVSS v3.1 score of 9.9 (NETWORK attack, low complexity, no user interaction, scope ...

Amazon Linux 2023 : php8.3, php8.3-bcmath, php8.3-cli (ALAS2023-2026-1961)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1961 advisory. PHP: Failure to setup TLS with a remote server can result in a remote DoS CVE-2026-12184 PHP: ext/openssl: Memory corruption zendmmheap corrupted in opensslencrypt with AES-WRAP-PAD...

CVE-2026-40187: Improper Neutralization of Special Elements used in an OS Command

In egroupware version 26.0 and earlier, an authenticated administrator can achieve OS-level Remote Code Execution RCE by uploading a malicious eTemplate XML file .xet to the VFS /etemplates mount. The Widget::expandname method passes template widget attribute values directly into a PHP eval call...

PT-2026-61753

A vulnerability was determined in D-Link DNS-320 1.0.2. This issue affects some unknown processing of the file /web/web file/upload.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack can be launched remotely. The exploit has been publicly disclosed and...

Medium: php8.5

Issue Overview: PHP: ext/openssl: Memory corruption zendmmheap corrupted in opensslencrypt with AES-WRAP-PAD CVE-2026-14355 Affected Packages: php8.5 Issue Correction: Run dnf update php8.5 --releasever 2023.12.20260720 or dnf update --advisory ALAS2023-2026-1957 --releasever 2023.12.20260720 to...

PT-2026-61620

Name of the Vulnerable Software and Affected Versions FileThingie version 2.5.7 Description A remote attacker can obtain sensitive information through the 'ft2.php' component. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability...

Amazon Linux 2023 : php8.5, php8.5-bcmath, php8.5-cli (ALAS2023-2026-1957)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1957 advisory. PHP: ext/openssl: Memory corruption zendmmheap corrupted in opensslencrypt with AES-WRAP-PAD CVE-2026-14355 Tenable has extracted the preceding description block directly from the tested product securi...

EUVD-2026-45991

An issue in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via the ft2.php component...

Medium: php8.4

Issue Overview: PHP: ext/openssl: Memory corruption zendmmheap corrupted in opensslencrypt with AES-WRAP-PAD CVE-2026-14355 Affected Packages: php8.4 Issue Correction: Run dnf update php8.4 --releasever 2023.12.20260720 or dnf update --advisory ALAS2023-2026-1959 --releasever 2023.12.20260720 to...