CVE-2026-88023 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB PHP Library

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

CVE-2026-88023 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB PHP Library

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

CVE-2026-88023 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB PHP Library

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

CVE-2026-88023

CVE-2026-88023 affects the GridFS component of the MongoDB PHP Library . The root cause is query-operator injection : a caller-supplied structured file identifier is interpreted as a query condition rather than a literal identifier due to improper neutralization of special elements in data query ...

GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB PHP Library

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

CVE-2026-73699

FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary code by exploiting incorrect options passed to unserialize in the Perms::getPerms method, where a positional array is used instead of the required named-key array to...

EUVD-2026-75601

FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary code by exploiting incorrect options passed to unserialize in the Perms::getPerms method, where a positional array is used instead of the required named-key array to...

CVE-2026-73699 FileRun < 2026.3.0 PHP Object Injection via Perms::getPerms()

FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary code by exploiting incorrect options passed to unserialize in the Perms::getPerms method, where a positional array is used instead of the required named-key array to...

CVE-2026-73699 FileRun < 2026.3.0 PHP Object Injection via Perms::getPerms()

FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary code by exploiting incorrect options passed to unserialize in the Perms::getPerms method, where a positional array is used instead of the required named-key array to...

CVE-2026-79987

A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker...

EUVD-2026-75586

A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker...

CVE-2026-81784

Deserialization of Untrusted Data vulnerability in Marcin Wise Chat wise-chat allows Object Injection.This issue affects Wise Chat: from n/a through 3.4.2...

CVE-2026-81784 WordPress Wise Chat plugin <= 3.4.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Marcin Wise Chat wise-chat allows Object Injection.This issue affects Wise Chat: from n/a through 3.4.2...

CVE-2026-81784

An unauthenticated PHP Object Injection vulnerability affects the WordPress Wise Chat plugin in versions ≤ 3.4 , as discovered by Peng Zhou . The flaw allows a remote attacker with no prior access or user interaction to inject a crafted serialized object, leading to high impact on confidentiality...

CVE-2026-81784 WordPress Wise Chat plugin <= 3.4.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Marcin Wise Chat wise-chat allows Object Injection.This issue affects Wise Chat: from n/a through 3.4.2...

EUVD-2026-75517

Unauthenticated PHP Object Injection in Wise Chat = 3.4 versions...

USN-8743-1 php8.1, php8.3, php8.5 vulnerabilities

It was discovered that PHP incorrectly handled backslash escaping in the PostgreSQL extension. An attacker could use this issue to perform SQL injection attacks. CVE-2026-17543 It was discovered that PHP incorrectly handled certain inputs to the bccomp function. An attacker could use this issue t...

USN-8743-1: PHP vulnerabilities

It was discovered that PHP incorrectly handled backslash escaping in the PostgreSQL extension. An attacker could use this issue to perform SQL injection attacks. CVE-2026-17543 It was discovered that PHP incorrectly handled certain inputs to the bccomp function. An attacker could use this issue t...

Apache Thrift Python, Go, PHP and Java bindings have an Infinite Loop

Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0.Users are recommended to upgrade to version 0.24.0, which fixes the issue...

CVE-2026-82925

The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or...