php:7.4 security, bug fix, and enhancement update

libzip php 7.4.33-5 - Fix Memory corruption zendmmheap corrupted in opensslencrypt with AES-WRAP-PAD CVE-2026-14355 php-pear php-pecl-apcu php-pecl-rrd php-pecl-xdebug php-pecl-zip...

CVE-2026-67339

creationtimestamp| type| source ---|---|--- 2026-08-01 22:02:19+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms2huriq3b2x 2026-08-01 22:02:27+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3ms2huylfhn2c 2026-08-01 22:02:35+00:00| seen|...

CVE-2026-14839

creationtimestamp| type| source ---|---|--- 2026-08-01 14:47:47+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrzplqscwp24 2026-08-01 14:47:58+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mrzpm3kkkt22 2026-08-01 15:05:46+00:00| seen|...

CVE-2026-14292

creationtimestamp| type| source ---|---|--- 2026-08-01 14:42:15+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrzpbtsapf2b 2026-08-01 14:42:35+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mrzpcgogvh2r 2026-08-01 15:10:33+00:00| seen|...

CVE-2026-15262

creationtimestamp| type| source ---|---|--- 2026-08-01 14:36:25+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrzoxgorwc2v 2026-08-01 14:36:46+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mrzoy2lsvc2p 2026-08-01 15:07:22+00:00| seen|...

CVE-2026-10773

The DHCPv4 client helper netdhcpv4msgtypename in subsys/net/lib/dhcpv4/dhcpv4.c indexes a static 8-element const char name table after a faulty bounds check. The guard used msgtype = sizeofname instead of msgtype = ARRAYSIZEname; sizeof returns the byte size of the pointer array 32 on 32-bit, 64 ...

NIP-44 v2 decryption permits resource exhaustion

The NIP-44 decryption entry point Base64-decoded the complete attacker-controlled payload before determining its version or enforcing any size limit. For v2 payloads, the decoded buffer was then authenticated with HMAC even when it was much larger than the maximum payload supported by the crate's...

NIP-98 authorization parsing permits resource exhaustion

The NIP-98 HTTP authorization parser Base64-decoded the complete authorization value and parsed the resulting JSON event without applying an application-level size limit. Both operations occurred before the event's signature and authorization fields could be validated. An unauthenticated remote...

[SECURITY] Fedora 44 Update: php-8.5.9-1.fc44

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

[SECURITY] Fedora 44 Update: postgresql16-16.14-1.fc44

PostgreSQL is an advanced Object-Relational database management system DBMS. The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine a...

PT-2026-67576

Name of the Vulnerable Software and Affected Versions Node.js versions 22.x and earlier Node.js versions 24.x and earlier Node.js versions 26.x and earlier Description A flaw in the Node.js HTTP client can lead to request desynchronization in Node.js-based forwarding proxies. This occurs when...

libblkid-devel-2.42.2-1.1 on GA media (moderate)

libblkid-devel-2.42.2-1.1 on GA media Announcement ID: openSUSE-SU-2026:11408-1 Rating: moderate Cross-References: CVE-2026-13595 CVE-2026-53612 CVE-2026-53613 CVE-2026-53614 CVSS scores: CVE-2026-13595 SUSE : 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H CVE-2026-13595 SUSE : 6.9...

Oracle Linux 8 : nodejs:24 (ELSA-2026-47060)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-47060 advisory. - Backport patches for various CVEs Fixes: CVE-2026-59873 CVE-2026-59874 CVE-2026-13149 Resolves: RHEL-194176 RHEL-194179 RHEL-208658 Tenable has...

NPM: @apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header

NPM: @apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header vulnerability discovered by ? in WordPress Npm apostrophe versions = 4.30.0...

NPM: Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass

NPM: Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass vulnerability discovered by ? in WordPress Npm apostrophe versions = 4.30.0...

[SECURITY] [DSA 6406-1] php8.4 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6406-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 31, 2026 https://www.debian.org/security/faq -...

CVE-2026-65981

CVE-2026-65981 affects Coturn prior to 4.15.0. A MOBILITY-TICKET–based session-resume flaw allows an authenticated attacker to bypass per-allocation authorization: a resumed REFRESH is validated against the attacker’s identity instead of the original allocation owner, enabling cross-user receipt ...

CVE-2026-65841

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element nested directly in SVG or MathML to remain in editor.value and execute when conte...

DEBIAN-CVE-2026-62959

Coturn is a free open source implementation of TURN and STUN Server. From 4.5.2 through 4.14.0, when Coturn is started with --acme-redirect and exposes a plaintext-TCP listener, an unauthenticated remote client can send a single ordinary HTTP GET request and receive a 301 response whose Location...

EUVD-2026-51627

Coturn is a free open source implementation of TURN and STUN Server. From 4.5.2 through 4.14.0, when Coturn is started with --acme-redirect and exposes a plaintext-TCP listener, an unauthenticated remote client can send a single ordinary HTTP GET request and receive a 301 response whose Location...