CVE-2026-39576: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in SingleMalt = 1.5 versions...

PT-2026-50544

Name of the Vulnerable Software and Affected Versions PHP Standard Library PSL versions 6.1.0 through 6.1.1 PHP Standard Library PSL version 6.2.0 Description The PslH2ServerConnection function does not validate that the total bytes received in DATA frames match the content-length header declared...

CVE-2025-69162: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Grecko = 5.17 versions...

CVE-2026-39443: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in EmallShop = 2.4.21 versions...

GHSA-F59H-Q822-G45G Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`

Summary forwardauth copyheaders deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through phpfastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with . This lets a client send an underscor...

CVE-2026-40761 WordPress Valeska theme <= 1.2.2 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Valeska = 1.2.2 versions...

CVE-2026-40761

WordPress Theme Valeska &lt;= 1.2.2 is affected by an unauthenticated PHP Object Injection vulnerability. Affected component: Valeska theme (WordPress). Root cause: PHP object injection in versions

CVE-2026-40759

CVE-2026-40759 affects WordPress Esmée theme versions

CVE-2026-40760 WordPress Behold theme <= 1.5 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Behold = 1.5 versions...

CVE-2026-40758 WordPress Léonie theme <= 1.2.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Léonie = 1.2.1 versions...

CVE-2026-40758 WordPress Léonie theme <= 1.2.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Léonie = 1.2.1 versions...

CVE-2026-40755 WordPress TechLink theme <= 1.3 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in TechLink = 1.3 versions...

CVE-2026-40754 WordPress Roisin theme <= 1.4 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Roisin = 1.4 versions...

CVE-2026-40755 WordPress TechLink theme <= 1.3 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in TechLink = 1.3 versions...

CVE-2026-40754

CVE-2026-40754 concerns the WordPress Roisin theme (versions &lt;= 1.4) with unauthenticated PHP Object Injection. Public references describe an object-injection vulnerability in Roisin

CVE-2026-40755

CVE-2026-40755 affects WordPress TechLink theme versions

CVE-2026-40751

CVE-2026-40751 affects WordPress Theme Ashtanga versions

CVE-2026-40736 WordPress Laurits theme <= 1.5.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Laurits = 1.5.1 versions...

CVE-2026-40736

WordPress Laurits theme

CVE-2026-39580

The CVE-2026-39580 entry covers an Unauthenticated PHP Object Injection in the WordPress theme Micdrop versions up to 1.3.1 . The affected component is the Micdrop WordPress theme; the root cause is a PHP Object Injection vulnerability in versions