CVE-2026-17543: Improper Neutralization of Special Elements used in an SQL Command

Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9...

PT-2026-66458

Name of the Vulnerable Software and Affected Versions PHP versions 8.4.0 through 8.4.23 PHP versions 8.5.0 through 8.5.8 Description Attacker-provided inputs to the bccomp function can lead to an out-of-bounds write, resulting in stack and heap corruption. An out-of-bounds write occurs when a...

CVE-2026-67206: Unrestricted Upload of File with Dangerous Type

Wolf CMS through 0.8.3.1 contains a remote code execution vulnerability in FileManagerController that allows authenticated attackers to create arbitrary PHP files by exploiting missing file extension validation in the createfile and save functions. Attackers with the filemanagermkfile capability...

CVE-2026-14602: Improper Control of Generation of Code

The Remote API WordPress plugin through 0.2 does not authenticate a request before deserializing user-supplied input, allowing unauthenticated attackers to inject arbitrary PHP objects, which can lead to remote code execution when a suitable gadget chain is present through another installed Remot...

CVE-2026-57859: Deserialization of Untrusted Data

e107 prior to version 2.3.8 contains a code execution vulnerability in the earray deserialization handler that allows an attacker with out-of-band database write access to execute arbitrary PHP code by storing a crafted payload in the userprefs column. The earray::unserialize function in...

EUVD-2026-51328

An issue in dnsmgr v.2.15 and before allows a local attacker to execute arbitrary code via the ping function of the CheckUils.php file...

CVE-2026-17544: Out-of-bounds Write

Attacker-provided inputs to bccomp could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4. before 8.4.24 and from 8.5. before 8.5.9...

Linux Distros Unpatched Vulnerability : CVE-2026-17544

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Attacker-provided inputs to bccomp could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4. before 8.4.24 and from 8.5...

CVE-2026-7260: Stack-based Buffer Overflow

Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9...

PT-2026-66463

Name of the Vulnerable Software and Affected Versions PHP versions 8.2.0 through 8.2.32 PHP versions 8.3.0 through 8.3.32 PHP versions 8.4.0 through 8.4.23 PHP versions 8.5.0 through 8.5.8 Description Circular symbolic links in phar archives can cause unbounded recursion, which exhausts the C sta...

vim security update

9.1.083-9.0.1.el102.12 - Remove upstream references Orabug: 31197557 2:9.1.083-9.12 - RHEL-201113 CVE-2026-59856 vim: potential command execution in PHP omni-completion 2:9.1.083-9.11 - RHEL-203857 CVE-2026-59858 vim: arbitrary Ex command execution during C omni-completion 2:9.1.083-9.10 -...

RockyLinux 9 : vim (RLSA-2026:47982)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:47982 advisory. vim: Vim: Denial of Service via stack out-of-bounds write in spellsoundfoldsofo CVE-2026-57455 vim: Vim: Arbitrary code execution via malicious docstrin...

RHEL 9 : vim (RHSA-2026:47982)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:47982 advisory. Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: Vim: Denial of Service via stack out-of-bounds...

Linux Distros Unpatched Vulnerability : CVE-2026-17543

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before...

PHP 8.3.x < 8.3.33 Multiple Vulnerabilities SQLI

The version of PHP installed on the remote host is prior to 8.3.33. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.3.33 advisory. - Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8....

PHP 8.2.x < 8.2.33 Multiple Vulnerabilities SQLI

The version of PHP installed on the remote host is prior to 8.2.33. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.2.33 advisory. - Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8....

Linux Distros Unpatched Vulnerability : CVE-2026-7260

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2. befor...

PHP 8.5.x < 8.5.9 Multiple Vulnerabilities SQLI

The version of PHP installed on the remote host is prior to 8.5.9. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.5.9 advisory. - Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2...

php: ext/openssl: memory corruption in openssl_encrypt with AES-WRAP-PAD

A flaw was found in the OpenSSL extension of PHP. The AES-WRAP-PAD algorithm implementation uses the size of the plaintext length without accounting for the RFC 5649 expansion to allocate the output buffer for the AES key-wrap-with-padding operation. This may lead to an undersized memory allocati...

Low: Red Hat Security Advisory: php security, bug fix, and enhancement update

An update for php is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...