CVE-2026-14946

A high privileged remote attacker can upload a .php file and then request it directly from /uploads/.php to achieve arbitrary code execution due to improper file type validation which could result in full system compromise...

CVE-2026-14946

Frauscher Sensortechnik FDS102 for FAdC/FAdCi R2 is vulnerable to remote code execution due to improper file type validation . A high-privileged remote attacker can upload a .php file and then request it directly from /uploads/.php, leading to arbitrary code execution and potential full system co...

CVE-2026-14946 Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Remote Code Execution via malicious configuration file.

A high privileged remote attacker can upload a .php file and then request it directly from /uploads/.php to achieve arbitrary code execution due to improper file type validation which could result in full system compromise...

EUVD-2026-63217

A high privileged remote attacker can upload a .php file and then request it directly from /uploads/.php to achieve arbitrary code execution due to improper file type validation which could result in full system compromise...

WordPress Clearfy plugin < 2.4.3 - Admin+ PHP Object Injection via Settings Import vulnerability

Admin+ PHP Object Injection via Settings Import vulnerability discovered by Omar Elshopky in WordPress Plugin Clearfy Cache versions 2.4.3...

WordPress Newsletters plugin < 4.16 - Unauthenticated PHP Object Injection via Date Form Field vulnerability

Unauthenticated PHP Object Injection via Date Form Field vulnerability discovered by Sai Praneeth Koti in WordPress Plugin Newsletters versions 4.16...

WordPress Ajax Search Lite plugin < 4.14.5 - Unauthenticated PHP Object Injection via Search Statistics REST Endpoint vulnerability

Unauthenticated PHP Object Injection via Search Statistics REST Endpoint vulnerability discovered by Jakub Herman in WordPress Plugin Ajax Search Lite versions 4.14.5...

WordPress Flatastic theme <= 2.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Flatastic versions = 2.0...

CVE-2026-75963

The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the emesingleeventpagetemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .p...

CVE-2026-13405

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manageoptions capability and, on WordPress Multisite, non-super subsite administrators who do not otherwise...

CVE-2026-13405 Royal Elementor Addons < 1.7.1066 - Admin+ Remote Code Execution via Widget Builder

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manageoptions capability and, on WordPress Multisite, non-super subsite administrators who do not otherwise...

CVE-2026-13405 Royal Elementor Addons < 1.7.1066 - Admin+ Remote Code Execution via Widget Builder

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manageoptions capability and, on WordPress Multisite, non-super subsite administrators who do not otherwise...

EUVD-2026-63201

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manageoptions capability and, on WordPress Multisite, non-super subsite administrators who do not otherwise...

CVE-2026-13405

The Royal Addons for Elementor WordPress plugin (versions before 1.7.1066 ) is vulnerable to Remote Code Execution (RCE) . The flaw exists because the plugin fails to properly sanitise custom widget markup before writing it to a file that is subsequently executed. This allows authenticated users ...

EUVD-2026-63199

The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the emesingleeventpagetemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .p...

CVE-2026-75963

The Events Made Easy WordPress plugin (all versions up to and including 3.2.5 ) is vulnerable to Local File Inclusion via the eme_single_event_page_template function, specifically through the wp_page_template event property. Authenticated attackers with contributor-level access or above can injec...

CVE-2026-75963 Events Made Easy <= 3.2.5 - Authenticated (Contributor+) Local File Inclusion via 'wp_page_template' Event Property

The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the emesingleeventpagetemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .p...

VulnCheck KEV: CVE-2026-77647

SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect identification of ?php blocks, and varexport's mishandling of certain cases such as presence of a '' character...

Important: php:8.2 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archives CVE-2026-7260 Bug Fixes and Enhancements...

RHEL 9 : php:8.3 (RHSA-2026:57539)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:57539 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext-pgsql: PHP: SQL injection vi...