CVE-2026-65576 WordPress Adrena theme <= 1.2.14 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Adrena = 1.2.14 versions...

CVE-2026-65574 WordPress Abogado theme <= 1.18 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Abogado = 1.18 versions...

CVE-2026-65572 WordPress A.Williams theme <= 1.3.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in A.Williams = 1.3.1 versions...

CVE-2026-65573 WordPress Abelle theme <= 1.22 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Abelle = 1.22 versions...

CVE-2026-65571

Unauthenticated PHP Object Injection in 69 Clothing = 1.2.11.1 versions...

CVE-2026-65571

Summary: CVE-2026-65571 describes an unauthenticated PHP Object Injection in WordPress 69 Clothing theme, versions

CVE-2026-65556

Unauthenticated PHP Object Injection in WPBruiser no- Captcha anti-Spam = 3.1.43 versions...

EUVD-2026-53983

Unauthenticated PHP Object Injection in WPBruiser no- Captcha anti-Spam = 3.1.43 versions...

CVE-2026-65556 WordPress WPBruiser {no- Captcha anti-Spam} plugin <= 3.1.43 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in WPBruiser no- Captcha anti-Spam = 3.1.43 versions...

EUVD-2026-53825

A security vulnerability has been detected in SourceCodester Computer Repair Shop Management System 1.0. Affected by this issue is some unknown functionality of the file /classes/Master.php?f=deleteproduct. Such manipulation of the argument ID leads to sql injection. It is possible to launch the...

Security update for php8 (critical)

openSUSE security update: security update for php8 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21532-1 Rating: critical References: bsc1273075 bsc1273076 bsc1273077 bsc1273078 Cross-References: CVE-2026-17543 CVE-2026-17544 CVE-2026-7260...

SUSE SLES15: apache2-mod_php7 / php7 / php7-bcmath / php7-bz2 / php7-calendar / etc (SUSE-SU-2026:3510-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3510-1 advisory. - CVE-2026-7260: Stack overflow in phar with circular symlinks bsc1273077. - CVE-2026-9672: Upgrade libgd bsc1273078. -...

SUSE SLES15: apache2-mod_php8 / php8 / php8-bcmath / php8-bz2 / php8-calendar / etc (SUSE-SU-2026:3509-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3509-1 advisory. Update to version 8.3.33. Security issues fixed: - CVE-2026-7260: circular symbolic links in phar archives can lead to unbounded...

OS Command injection

Impact PHPCodeSniffer versions before v3.13.6 and v4.0.2 contain a command injection vulnerability in the code creating the Gitblame, Hgblame and Svnblame reports. As a result, running PHPCodeSniffer over untrusted files, for example, in a CI pipeline that scans pull requests, or on a developer...

CVE-2026-18968

CVE-2026-18968 affects ttttonyhe OBlog up to 3ca6a45a2fcc81f6086751d8af124658720e8f8f. The vulnerability is in processing of the file /tags.php where manipulation of the day argument enables cross site scripting. The attack could be performed remotely, and the exploit has been publicly disclosed....

Security update for php7

This update for php7 fixes the following issues: CVE-2026-7260: circular symbolic links in phar archives can lead to unbounded recursion and cause C stack exhaustion bsc1273077. CVE-2026-9672: security issues in libgd bsc1273078. CVE-2026-17543: improper escaping of backslashes in user-provided...

SUSE-SU-2026:3509-1 Security update for php8

This update for php8 fixes the following issues: Update to version 8.3.33. Security issues fixed: - CVE-2026-7260: circular symbolic links in phar archives can lead to unbounded recursion and cause C stack exhaustion bsc1273077. - CVE-2026-9672: security issues in libgd bsc1273078. -...

CVE-2026-18933

The wp-downloadmanager WordPress plugin, in version 1.68.11 also affecting the 6.9.4 release line, allows an admin-privileged user currentusercan'managedownloads' to upload arbitrary files via download-add.php with no extension or MIME-type validation of any kind - no wpcheckfiletypeandext, no...

CVE-2026-71248

Inventory-Management-System-PHP's login.php constructs its authentication query via direct string concatenation of raw POST parameters: $sql = "select from user where email = '$email' and password = '$password'", with no escaping or parameterization, allowing authentication bypass via a payload...

CVE-2026-71237 Miantang IoT-PHP - Unauthenticated SQL Injection in /userlogin

Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from 'pwd' with no sanitization and concatenates it into a raw SQL string: mysqlquery"select from userlists where username='' and password='' limit 1". An unauthenticated attacker can submit a payload...