Low: php security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext/openssl: memory corruption in opensslencrypt with AES-WRAP-PAD CVE-2026-14355 php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Servic...

ALSA-2026:61259 Low: php security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext/openssl: memory corruption in opensslencrypt with AES-WRAP-PAD CVE-2026-14355 php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Servic...

ROS-20260831-73-0018

The vulnerability of the DOMNode::C14N method in the PHP programming language is related to the execution of a loop with an unreachable exit condition. Exploiting this vulnerability can allow an attacker to cause service failures remotely...

Medium: gd

Issue Overview: NOTE: Fixed by: https://github.com/php/php-src/commit/b590f0380fda26ed180874a0255f0be078434315 php-8.4.24 DEBIANBUG: 1143152 CVE-2026-9672 Affected Packages: gd Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference betwe...

Medium: gd

Issue Overview: NOTE: Fixed by: https://github.com/php/php-src/commit/b590f0380fda26ed180874a0255f0be078434315 php-8.4.24 DEBIANBUG: 1143152 CVE-2026-9672 Affected Packages: gd Issue Correction: Run dnf update gd --releasever 2023.12.20260831 or dnf update --advisory ALAS2023-2026-2103 --releasev...

RockyLinux 9 : php (RLSA-2026:61259)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:61259 advisory. php: ext/openssl: memory corruption in opensslencrypt with AES-WRAP-PAD CVE-2026-14355 php: ext-pgsql: PHP: SQL injection via improper backslash escapin...

RHEL 9 : php (RHSA-2026:61259)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:61259 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext/openssl: memory corruption i...

Amazon Linux 2 : gd, --advisory ALAS2-2026-3870 (ALAS-2026-3870)

The version of gd installed on the remote host is prior to 2.0.35-27. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3870 advisory. NOTE: Fixed by: https://github.com/php/php-src/commit/b590f0380fda26ed180874a0255f0be078434315 php-8.4.24DEBIANBUG: 1143152...

CVE-2026-81890: Cross-Site Request Forgery (CSRF)

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, the netmount command is omitted from elFinderConnector::$csrfProtectedCmds in php/elFinderConnector.class.php, so validateCsrfToken is not called for this state-changing operation. In the...

php-composer2-2.10.3-1.1 on GA media (moderate)

php-composer2-2.10.3-1.1 on GA media Announcement ID: openSUSE-SU-2026:11633-1 Rating: moderate Cross-References: CVE-2026-59944 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the...

MINI-PHFW-96XM-7673

Bulletin has no description...

TeamPass v3.2.2.0

Teampass Self-hosted password management your whole team can trust Folder-level access control · authenticated AES-256-GCM encryption · compliance evidence Your secrets never leave your infrastructure. 🌐teampass.net · 📖Documentation · 💬Discussions · 🐳Docker Hub Contents About Who it's for Securit...

Exploit for CVE-2026-82222

CVE-2026-82222 Unauthenticated PHP object injection to RCE...

EUVD-2026-68139

A weakness has been identified in PHPGurukul Student Information System 1.0. Affected by this vulnerability is an unknown functionality of the file /studentedit1.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be launched remotely. The exploit has been...

SPIP Autosave Session Unauthenticated RCE

This module exploits an unauthenticated RCE in SPIP use exploit/multi/http/spip/autosaverce msf undefinedautosaverce show actions ...actions... msf undefinedautosaverce set ACTION msf undefinedautosaverce show options ...show and set options... msf undefinedautosaverce run This module requires...

CVE-2026-82424

PHPGurukul Student Information System 1.0 contains a SQL injection vulnerability in the file /student_edit1.php , triggered by manipulating the ID argument. The attack can be launched remotely with low privileges and no user interaction. The exploit has been made publicly available as a proof-of-...

CVE-2026-82424 PHPGurukul Student Information System student_edit1.php sql injection

A weakness has been identified in PHPGurukul Student Information System 1.0. Affected by this vulnerability is an unknown functionality of the file /studentedit1.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be launched remotely. The exploit has been...

CVE-2026-82424 PHPGurukul Student Information System student_edit1.php sql injection

A weakness has been identified in PHPGurukul Student Information System 1.0. Affected by this vulnerability is an unknown functionality of the file /studentedit1.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be launched remotely. The exploit has been...

CVE-2026-82450

BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP fil...

CVE-2026-82450

BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP fil...