Block AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-192

The Block AJAX module enables you to load blocks asynchronously via Ajax. The module doesn't sufficiently validate user-supplied data which is used to construct a block. In the worst case scenario, this can lead to PHP Object Injection and Remote Code Execution. The vulnerability is mitigated by...

CentOS Linux 8 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1791395301)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1791395301 advisory. - The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes fo...

PT-2026-107742

The Block AJAX module enables you to load blocks asynchronously via Ajax. The module doesn't sufficiently validate user-supplied data which is used to construct a block. In the worst case scenario, this can lead to PHP Object Injection and Remote Code Execution. The vulnerability is mitigated by...

Linux Distros Unpatched Vulnerability : CVE-2026-82531

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocachehash is never restored during extends:/multi-compone...

PT-2026-107405

The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution feature to administrators, gating it on a content capability that the Editor role holds by default, which allows Editor-level users to save and execute arbitrary PHP code on the server and fully compromi...

RCE-Simplephpblog-biggiedroid

CVE-2025-15495 - Caricamento Arbitrario di File Che Porta all'Esecuzione Remota di Codice RCE Prodotto BiggiDroid – Simple PHP Blog CMS Pagina del prodotto: https://biggidroid.com/product/simple-php-blog/ Tipo di Vulnerabilità Caricamento Arbitrario di File Caricamento di File senza Restrizioni...

cve-2026-87902-poc

CVE-2026-87902 — WordPress Core: path traversal non autenticato nella risoluzione dei template di pagina Inclusione locale non autenticata di file PHP in WordPress Core tramite un valore pagename con doppia codifica — e, in specifiche condizioni di deployment, esecuzione di codice PHP con i...

CVE-2005-0603-phpBB-2.0.12-Full-path-disclosure

CVE: https://vulners.com/cve/CVE-2005-0603 Neo Security Team NST® - Avviso 06 - 25/02/05 Programma: phpBB 2.0.12 Homepage: http://www.phpbb.com Versioni vulnerabili: phpBB 2.0.12 e versioni precedenti Rischio: Basso rischio!! Impatto: Divulgazione del percorso completo -==phpBB 2.0.12 Divulgazion...

CVE-2026-6103 affecting package php for versions less than 8.3.35-1

CVE-2026-6103 affecting package php for versions less than 8.3.35-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-91766 affecting package php for versions less than 8.3.35-1

CVE-2026-91766 affecting package php for versions less than 8.3.35-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-91767 affecting package php for versions less than 8.3.35-1

CVE-2026-91767 affecting package php for versions less than 8.3.35-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-17545 affecting package php for versions less than 8.3.35-1

CVE-2026-17545 affecting package php for versions less than 8.3.35-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-14181 affecting package php for versions less than 8.3.35-1

CVE-2025-14181 affecting package php for versions less than 8.3.35-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-92842 affecting package php for versions less than 8.3.35-1

CVE-2026-92842 affecting package php for versions less than 8.3.35-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-91768 affecting package php for versions less than 8.3.35-1

CVE-2026-91768 affecting package php for versions less than 8.3.35-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-91765 affecting package php for versions less than 8.3.35-1

CVE-2026-91765 affecting package php for versions less than 8.3.35-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-91769 affecting package php for versions less than 8.3.35-1

CVE-2026-91769 affecting package php for versions less than 8.3.35-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-1218 affecting package php for versions less than 8.3.35-1

CVE-2025-1218 affecting package php for versions less than 8.3.35-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-93682 affecting package php for versions less than 8.3.35-1

CVE-2026-93682 affecting package php for versions less than 8.3.35-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-104070

The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu anti-forgery parameter in crayonsstore.php, causing the authorization dispatcher to resolve an...