CVE-2026-46636: Improper Neutralization of Special Elements Used in a Template Engine

Twig is a template language for PHP. From version 1.0.0 to before version 3.27.0, SecurityPolicy::checkMethodAllowed unconditionally whitelists all method calls on instances of Twig\Markup. Twig\Markup is not final, so subclasses inherit the bypass. An application that passes an object of a...

Flextype CMS 1.0.0-alpha.3 Code Execution

Flextype CMS version 1.0.0-alpha.3 contains a stored code execution vulnerability caused by the interaction between globally processed entry expressions, the mutable registry object exposed to expressions, and the PHP entry directive. https://packetstorm.news/download/230567...

PT-2026-86237

Name of the Vulnerable Software and Affected Versions ApiAdmin version 5.0.1 Description A file upload flaw allows a remote attacker to execute arbitrary code by uploading a specially crafted .php file. Recommendations At the moment, there is no information about a newer version that contains a f...

CVE-2026-71620

File Upload vulnerability in Zhao-github ApiAdmin v.5.0.1 allows a remote attacker to execute arbitrary code via a crafted .php file...

php security, bug fix, and enhancement update

8.0.30-8 - Fix leak on double DatePeriod::construct call - Fixed SQL injection via E'...' backslash breakout CVE-2026-17543 - Fixed GHSA-vc5h-9ppw-p5f3 Crash via recursive symlinks CVE-2026-7260 8.0.30-7 - Fix Memory corruption zendmmheap corrupted in opensslencrypt with AES-WRAP-PAD CVE-2026-143...

ROS-20260904-73-0007

The vulnerability in php-phpseclib is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service failures...

Flextype CMS 1.0.0-alpha.3 Remote Code Execution

Flextype CMS version 1.0.0-alpha.3 contains a remote code execution vulnerability in the interaction between the Entries API and Shortcodes::registerShortcodes. The /api/v1/entries endpoint accepts an attacker-controlled entry identifier that can contain path traversal sequences, allowing content...

OPENSUSE-SU-2026:11689-1 php-composer2-2.10.3-2.1 on GA media

These are all security issues fixed in the php-composer2-2.10.3-2.1 package on the GA media of openSUSE Tumbleweed...

The vulnerability of the AppAuthentication::verifyCode() method in the packages/panels/src/Auth/MultiFactor/App/AppAuthentication.php file of the component set for the accelerated development of the Filament PHP framework Laravel allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the AppAuthentication::verifyCode method in the packages/panels/src/Auth/MultiFactor/App/AppAuthentication.php file of the Filament PHP framework’s Laravel set is related to the possibility of bypassing the authentication process. Exploiting this vulnerability could allow an...

Linux Distros Unpatched Vulnerability : CVE-2026-76060

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitiz...

MiracleLinux 8 : php:7.4 (AXSA:2026-1772:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1772:01 advisory. php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar...

Oracle Linux 9 : ELSA-2026-61259-0: / php (ELSA-2026-612590)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-612590 advisory. - Fixed SQL injection via E'...' backslash breakout CVE-2026-17543 - Fixed GHSA-vc5h-9ppw-p5f3 Crash via recursive symlinks CVE-2026-7260 Tenable has...

CVE-2026-71620: Unrestricted Upload of File with Dangerous Type

File Upload vulnerability in Zhao-github ApiAdmin v.5.0.1 allows a remote attacker to execute arbitrary code via a crafted .php file...

MINI-PHRP-C2QX-VF5P

Bulletin has no description...

CVE-2026-13001

CVE-2026-13001 — Podlove Podcast Publisher Unauthenticated File Upload RCE isimage vs extractfileextension Mismatch → PHP Polyglot Upload Overview CVE-2026-13001 is a critical-severity CVSS 9.8 unauthenticated arbitrary file upload vulnerability in the Podlove Podcast Publisher WordPress plugin...

EUVD-2026-70732

A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. The affected element is the function doInsert of the file /rider/orders/controller.php?action=add of the component Order Management Controller. Performing a manipulation of the argument image results in...

CVE-2026-84968

An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error message that is returned to application code. This may result in unintended...

DEBIAN-CVE-2026-84968

An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error message that is returned to application code. This may result in unintended...

CVE-2026-84968

An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error message that is returned to application code. This may result in unintended...

UBUNTU-CVE-2026-84968

An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error message that is returned to application code. This may result in unintended...