109862 matches found
EUVD-2026-74283
Maravel, a PHP framework oriented towards dependency injection, prior to version 10.73.1 has a side-channel information disclosure issue. When a route was compiled with dynamic placeholders e.g., /api/v1/users/id, the raw string placeholder key was mistakenly registered into the flat static route...
CVE-2026-53933 Maravel-Framework Vulnerable to Side-Channel Information Disclosure (Error Oracle) via Dynamic Route Fuzzing
Maravel, a PHP framework oriented towards dependency injection, prior to version 10.73.1 has a side-channel information disclosure issue. When a route was compiled with dynamic placeholders e.g., /api/v1/users/id, the raw string placeholder key was mistakenly registered into the flat static route...
mongodb: Reject "." and NUL bytes in database and collection names
Impact Passing untrusted input as part of a database or collection name may result in targeting a different database or collection than specified. Patches Fixed in PHP library 1.21.4 and 2.4.1. Workarounds Validate database and collection names prior to passing into APIs...
GHSA-65FR-J4P9-VC33 mongodb: Reject "." and NUL bytes in database and collection names
Impact Passing untrusted input as part of a database or collection name may result in targeting a different database or collection than specified. Patches Fixed in PHP library 1.21.4 and 2.4.1. Workarounds Validate database and collection names prior to passing into APIs...
EUVD-2026-67209
mongodb: Reject "." and NUL bytes in database and collection names...
EUVD-2026-69608
Composer arbitrary command execution via a malicious package's Perforce source URL...
Command Injection
Overview composer/composer is a Dependency Manager for PHP. Composer helps you declare, manage and install dependencies of PHP projects. It ensures you have the right stack everywhere. Affected versions of this package are vulnerable to Command Injection via the handling of Perforce source...
EUVD-2026-69576
phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery...
CVE-2026-78625
The Okta Access Gateway does not sanitize dashboard label values before writing them into generated PHP configuration files. The generated file is automatically included during authentication requests, resulting in execution with the privileges of the web server process...
CVE-2026-78625 Insufficient Validation of Dashboard Application Labels in Okta Access Gateway Dashboard Site Configuration
The Okta Access Gateway does not sanitize dashboard label values before writing them into generated PHP configuration files. The generated file is automatically included during authentication requests, resulting in execution with the privileges of the web server process...
CVE-2026-78625 Insufficient Validation of Dashboard Application Labels in Okta Access Gateway Dashboard Site Configuration
The Okta Access Gateway does not sanitize dashboard label values before writing them into generated PHP configuration files. The generated file is automatically included during authentication requests, resulting in execution with the privileges of the web server process...
EUVD-2026-74173
The Okta Access Gateway does not sanitize dashboard label values before writing them into generated PHP configuration files. The generated file is automatically included during authentication requests, resulting in execution with the privileges of the web server process...
CVE-2026-78625
Okta Access Gateway is affected by an insufficient validation vulnerability in its dashboard site configuration . The product fails to sanitize dashboard application label values before writing them into generated PHP configuration files . Since the generated file is automatically included during...
CVE-2026-86810 Open-Web-Analytics Controller Controller.php checkCapabilityAndAuthenticateUser improper authentication
A vulnerability was detected in Open-Web-Analytics up to 1.9.1. The impacted element is the function checkCapabilityAndAuthenticateUser of the file Core/Controller.php of the component Controller. Performing a manipulation results in improper authentication. The attack may be initiated remotely...
Exploit for CVE-2026-82222
⚡ GHOSTLYR00T - GiveWP RCE Exploit Framework...
Exploit for Deserialization of Untrusted Data in Devcode Openstamanager
CVE-2026-29782 — OpenSTAManager auth-SQLi → PHP object injecti...
CVE-2026-54611 InstantCMS has Remote Code Execution in package installer
InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution RCE issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, ...
CVE-2026-54611
InstantCMS , a free and open-source content management system, contains a Remote Code Execution vulnerability in its component installer in versions prior to 2.18.2 . A remote authenticated attacker can upload a malicious component; although the component is not formally installed, the uploaded P...
CVE-2026-54611 InstantCMS has Remote Code Execution in package installer
InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution RCE issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, ...