95646 matches found
GO-2022-1059 vulnerabilities
Vulnerabilities for packages: vt-cli, hey, gitleaks, php-fpmexporter, k3d, kubeflow, grpcurl, dynamic-localpv-provisioner, terraform-provider-sendgrid...
WordPress WooCommerce Subscriptions plugin < 9.1.0 - Unauthenticated RCE via PHP Object Injection vulnerability
Unauthenticated RCE via PHP Object Injection vulnerability discovered by Vasily Belolapotkov, Vlad Olaru in WordPress Plugin WooCommerce Subscriptions versions 9.1.0...
Client HttpTransport SSE buffer grows unbounded when server withholds the event delimiter
Summary The HTTP client transport in mcp/sdk reads a Server-Sent-Events SSE response stream incrementally and appends each 4 KiB chunk to an in-memory buffer $this-sseBuffer .= $chunk; with no upper bound. The buffer is only ever flushed when an SSE event delimiter "\n\n" appears. A remote MCP...
php security, bug fix, and enhancement update
An update is available for php. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list PHP is an HTML-embedded scripting language commonly used with the Apache HTTP...
php8.4 security, bug fix, and enhancement update
An update is available for php8.4. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list PHP is an HTML-embedded scripting language. PHP attempts to make it easy for...
php:8.3 security, bug fix, and enhancement update
An update is available for module.php-pecl-redis6, php, module.php-pecl-rrd, php-pecl-apcu, module.php-pecl-apcu, php-pecl-zip, php-pecl-rrd, module.php, module.php-pecl-zip, php-pecl-redis6, php-pecl-xdebug3, module.php-pecl-xdebug3. This update affects Rocky Linux 9. A Common Vulnerability...
php:8.2 security, bug fix, and enhancement update
An update is available for php, module.php-pecl-rrd, php-pecl-apcu, module.php-pecl-apcu, php-pecl-zip, php-pecl-rrd, module.php, module.php-pecl-zip, php-pecl-xdebug3, module.php-pecl-xdebug3. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a...
php:8.2 security, bug fix, and enhancement update
An update is available for module.libzip, php, module.php-pecl-rrd, php-pecl-apcu, module.php-pecl-apcu, libzip, php-pecl-zip, module.php-pecl-zip, php-pecl-rrd, module.php, php-pear, module.php-pear, php-pecl-xdebug3, module.php-pecl-xdebug3. This update affects Rocky Linux 8. A Common...
php:7.4 security, bug fix, and enhancement update
An update is available for module.php-pecl-xdebug, module.libzip, php, module.php-pecl-rrd, php-pecl-apcu, module.php-pecl-apcu, libzip, php-pecl-zip, php-pecl-rrd, module.php, php-pecl-xdebug, php-pear, module.php-pear, module.php-pecl-zip. This update affects Rocky Linux 8. A Common Vulnerabili...
MiracleLinux 8 : php:7.4 (AXSA:2026-1535:01)
The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1535:01 advisory. php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD CVE-2026-14355 Tenable has extracted the preceding description...
MiracleLinux 8 : php:8.2 (AXSA:2026-1538:01)
The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1538:01 advisory. php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD CVE-2026-14355 Tenable has extracted the preceding description...
CVE-2026-73533
Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file app/Library/updater/NinjaTableDataSync.php that established a backdoor REST API endpoint,...
CVE-2026-73532
Fluent Forms Pro 6.2.7 is affected by an embedded malicious-code vulnerability introduced via a tampered plugin build served from a decommissioned update server. A rogue PHP file, libs/class-license-sync.php, was loaded through a require_once in fluentformpro.php, creating a backdoor REST API end...
CVE-2026-73532 Fluent Forms Pro 6.2.7 Embedded Malicious Code via Tampered Plugin Build
Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file libs/class-license-sync.php, loaded via a requireonce directive added to fluentformpro.php,...
CVE-2026-73533
CVE-2026-73533 affects Ninja Tables Pro 5.2.11. The vulnerability is an embedded malicious code issue introduced via a tampered plugin build served through a decommissioned update server. A rogue file, app/Library/updater/NinjaTableDataSync.php, creates a backdoor REST API endpoint and drops pers...
CVE-2026-73671 Saurus CMS Unauthenticated Open Redirect via logout url parameter
Saurus CMS Community Edition contains an unauthenticated open redirect vulnerability in the logout handling code in classes/port.inc.php, where the url parameter supplied via GET or POST is passed directly to the Location header without domain allowlist, scheme validation, or relative path...
CVE-2026-19710
A vulnerability was found in SourceCodester Simple Student Information System. Affected by this vulnerability is an unknown functionality of the file app/admin/departments/viewdepartment.php. Performing a manipulation of the argument ID results in sql injection. The attack is possible to be carri...
CVE-2026-66653
Unauthenticated Local File Inclusion in Barista = 2.5.1 versions...