CVE-2026-39481: Deserialization of Untrusted Data

Author PHP Object Injection in Modula Image Gallery = 2.14.18 versions...

CVE-2026-39434: Deserialization of Untrusted Data

Shop manager PHP Object Injection in CTX Feed = 6.6.26 versions...

PT-2026-49507

Unauthenticated PHP Object Injection in WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms = 1.1.4 versions...

PT-2026-49399

Contributor PHP Object Injection in Events Calendar for GeoDirectory = 2.3.25 versions...

PT-2026-51135

Name of the Vulnerable Software and Affected Versions SP Page Builder for Joomla versions 1.0.0 through 6.6.1 Description A flaw in the SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, which can lead to the execution of PHP code on the server. The issue exists in...

CVE-2026-39471: Deserialization of Untrusted Data

Author PHP Object Injection in ShortPixel Image Optimizer = 6.4.3 versions...

CVE-2026-49770: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in WP Travel Engine = 6.7.12 versions...

CVE-2026-48157: Improper Neutralization of Input During Web Page Generation

Slim is a PHP micro framework that enables users to write simple web applications and APIs. In versions 4.4.0 through 4.15, if an application uses HttpException::setTitle and/or setDescription to include untrusted/request-derived data in the error title or description e.g. "No products found...

VulnCheck KEV: CVE-2026-48908

JoomShaper SP Page Builder contains an unrestricted upload of file with dangerous type vulnerability that allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code...

CVE-2026-49106: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Integration for Contact Form 7 and Constant Contact = 1.1.6 versions...

CVE-2026-38329

Bludit CMS versions prior to 3.18.4 are vulnerable to Remote Code Execution (RCE) within the API Plugin . The issue resides in the bl-plugins/api/plugin.php file, where the POST /api/files/{key} endpoint fails to perform adequate authorization checks and lacks file extension validation . Conseque...

[SECURITY] Fedora 43 Update: composer-2.10.1-1.fc43

Composer helps you declare, manage and install dependencies of PHP projects, ensuring you have the right stack everywhere. Documentation: https://getcomposer.org/doc/...

CVE-2026-12176

SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0 contains a cross-site scripting (XSS) vulnerability in an unknown function of the file /index.php when the action parameter is manipulated. The attack is remote and has been publicly disclosed . Exploit maturity is label...

CVE-2026-9062

The Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing high-privileged users such as administrators to read arbitrary .php files from the server, including configuration files that contain database credentials and authentication keys...

CVE-2026-9062 Agile Store Locator < 1.6.9 - Admin+ Arbitrary File Read via Path Traversal

The Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing high-privileged users such as administrators to read arbitrary .php files from the server, including configuration files that contain database credentials and authentication keys...

[SECURITY] Fedora 44 Update: composer-2.10.1-1.fc44

Composer helps you declare, manage and install dependencies of PHP projects, ensuring you have the right stack everywhere. Documentation: https://getcomposer.org/doc/...

CVE-2026-54362 MISP template builder exposes non-visible custom galaxies across organisations

An incorrect visibility condition in the MISP event template builder allowed authenticated non-site-admin users to view galaxies that should not have been visible to their organisation. The custom access-control condition intended to restrict galaxies to those owned by the user’s organisation or...

CVE-2026-54362

An incorrect visibility condition in the MISP event template builder allowed authenticated non-site-admin users to view galaxies that should not have been visible to their organisation. The custom access-control condition intended to restrict galaxies to those owned by the user’s organisation or...

EUVD-2026-35401

TYPO3 CMS has Insecure Deserialization via Core API...

CVE-2026-54133

jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elements from a JSON document, in PHP applications with PHP data structures. Versions prior to 2.9.1 can generate and execute attacker-controlled PHP code when JmesPath\CompilerRuntime is used with an...