EUVD-2026-70368

Unrestricted file upload vulnerability in the CSV file upload functionality of the Ocsreports admininfo endpoint. The application validates files solely based on the name provided by the client, without properly checking their content or securely restricting the permitted file types. This allows ...

secbench-dvwa

DAMN VULNERABLE WEB APPLICATION Damn Vulnerable Web Applicati...

CVE-2026-84968: Out-of-bounds Read

An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error message that is returned to application code. This may result in unintended...

CVE-2026-76174: Unrestricted Upload of File with Dangerous Type

Unrestricted file upload vulnerability in the CSV file upload functionality of the Ocsreports admininfo endpoint. The application validates files solely based on the name provided by the client, without properly checking their content or securely restricting the permitted file types. This allows ...

Linux Distros Unpatched Vulnerability : CVE-2026-84308

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - phpseclib is a PHP secure communications library. Prior to 3.0.57 and 4.0.1, pure-PHP X25519 scalar multiplication in phpseclib/Math/PrimeField/Integer.php...

CVE-2026-77999: External Control of Assumed-Immutable Web Parameter

Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - The PayPal IPN listener's signature check validateIPN accepted UNVERIFIED and any non-INVALID response as valid, made its verificati...

PT-2026-84973

Name of the Vulnerable Software and Affected Versions Ocsreports affected versions not specified Description An unrestricted file upload issue exists in the CSV file upload functionality of the 'admin info' endpoint. The application validates files based only on the client-provided name, failing ...

PT-2026-85095

Contributor PHP Object Injection in RTMKit = 2.1.5 versions...

CVE-2026-84752: Deserialization of Untrusted Data

Contributor PHP Object Injection in RTMKit = 2.1.5 versions...

PT-2026-85096

Name of the Vulnerable Software and Affected Versions Mail Mint versions prior to 1.31.1 Description Mail Mint is subject to PHP Object Injection, a condition where an application deserializes untrusted input, allowing an attacker to inject a PHP Object. While no POP chain a sequence of gadgets...

CVE-2026-84753: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Mail Mint = 1.31.0 versions...

RockyLinux 10 : php (RLSA-2026:62614)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:62614 advisory. php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar...

Oracle Linux 9 : ELSA-2026-61903-0: / php:8.2 (ELSA-2026-619030)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-619030 advisory. php 8.2.33-1 - rebase to 8.2.33 php-pecl-apcu 5.1.23-1 - update to 5.1.23 for PHP 8.2 RHEL-14699 php-pecl-rrd 2.0.3-4 - build for PHP 8.1 2070040...

CVE-2026-84834: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in JobSearch = 3.2.0 versions...

MiracleLinux 9 : php:8.2 (AXSA:2026-1748:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1748:01 advisory. php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar...

Oracle Linux 10 : ELSA-2026-62614-0: / php (ELSA-2026-626140)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-626140 advisory. 8.3.33-1 - rebase to 8.3.33 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus...

Linux Distros Unpatched Vulnerability : CVE-2026-84372

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 until version 3.3.0, pipeline handling on aggregate cluster an...

...[ More ]

ILIAS versions prior to 9.22, versions 10.0 through 10.9, and versions 11.0 through 11.2 contain an unauthenticated PHP object injection vulnerability in the Shibboleth logout functionality. An unauthenticated attacker can manipulate stored session data that is subsequently deserialized without...

PT-2026-85119

Unauthenticated PHP Object Injection in JobSearch = 3.2.0 versions...

PT-2026-85201

Name of the Vulnerable Software and Affected Versions MongoDB PHP driver affected versions not specified Description An out-of-bounds read occurs in the BSON decoding component. An unauthenticated party can provide specially formed input to cause a small amount of adjacent process memory to be...