Low: Red Hat Security Advisory: php:7.4 security, bug fix, and enhancement update

An update for the php:7.4 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

php: ext/openssl: memory corruption in openssl_encrypt with AES-WRAP-PAD

A flaw was found in the OpenSSL extension of PHP. The AES-WRAP-PAD algorithm implementation uses the size of the plaintext length without accounting for the RFC 5649 expansion to allocate the output buffer for the AES key-wrap-with-padding operation. This may lead to an undersized memory allocati...

CVE-2026-1360 BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data

The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 14.5.0 This is due to the bpunserializeprofilefield function using @unserialize without the allowedclasses parameter on user-controlled XProfile field data. This makes it...

CVE-2026-1360

BuddyPress for WordPress up to 14.5.0 is affected by a Deserialization of Untrusted Data flaw in bp_unserialize_profile_field(), which calls unserialize() without the allowed_classes parameter on user-controlled XProfile field data. This allows an authenticated attacker (subscriber level or highe...

CVE-2026-16610 Admin and Site Enhancements (ASE) Pro <= 8.9.0 - Unauthenticated Remote Code Execution via PHP Code Injection via cfgroup[input] Repeater Row Key

The Admin and Site Enhancements ASE Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.9.0 via the recursivehtml function. This is due to the frontend save handler enforces only a publicly emitted nonce with no authentication check, CAPTCHA...

CVE-2026-16610

CVE-2026-16610 , for the Admin and Site Enhancements (ASE) Pro WordPress plugin, is documented as allowing unauthenticated remote code execution in all versions up to 8.9.0 via the recursive_html function. The root cause is a vulnerable frontend save handler that relies on a publicly emitted nonc...

PT-2026-66458

Name of the Vulnerable Software and Affected Versions PHP versions 8.4.0 through 8.4.23 PHP versions 8.5.0 through 8.5.8 Description Attacker-provided inputs to the bccomp function can lead to an out-of-bounds write, resulting in stack and heap corruption. An out-of-bounds write occurs when a...

EUVD-2026-51328

An issue in dnsmgr v.2.15 and before allows a local attacker to execute arbitrary code via the ping function of the CheckUils.php file...

Linux Distros Unpatched Vulnerability : CVE-2026-7260

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2. befor...

vim security update

9.1.083-9.0.1.el102.12 - Remove upstream references Orabug: 31197557 2:9.1.083-9.12 - RHEL-201113 CVE-2026-59856 vim: potential command execution in PHP omni-completion 2:9.1.083-9.11 - RHEL-203857 CVE-2026-59858 vim: arbitrary Ex command execution during C omni-completion 2:9.1.083-9.10 -...

PT-2026-66463

Name of the Vulnerable Software and Affected Versions PHP versions 8.2.0 through 8.2.32 PHP versions 8.3.0 through 8.3.32 PHP versions 8.4.0 through 8.4.23 PHP versions 8.5.0 through 8.5.8 Description Circular symbolic links in phar archives can cause unbounded recursion, which exhausts the C sta...

Linux Distros Unpatched Vulnerability : CVE-2026-17543

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before...

Linux Distros Unpatched Vulnerability : CVE-2026-17544

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Attacker-provided inputs to bccomp could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4. before 8.4.24 and from 8.5...

PHP 8.3.x < 8.3.33 Multiple Vulnerabilities SQLI

The version of PHP installed on the remote host is prior to 8.3.33. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.3.33 advisory. - Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8....

PT-2026-66457

Name of the Vulnerable Software and Affected Versions PHP versions 8.2.0 through 8.2.32 PHP versions 8.3.0 through 8.3.32 PHP versions 8.4.0 through 8.4.23 PHP versions 8.5.0 through 8.5.8 Description Improper escaping of backslashes in attacker-provided parameters allows for SQL injection, a...

RockyLinux 9 : vim (RLSA-2026:47982)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:47982 advisory. vim: Vim: Denial of Service via stack out-of-bounds write in spellsoundfoldsofo CVE-2026-57455 vim: Vim: Arbitrary code execution via malicious docstrin...

RHEL 9 : vim (RHSA-2026:47982)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:47982 advisory. Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: Vim: Denial of Service via stack out-of-bounds...

PHP 8.5.x < 8.5.9 Multiple Vulnerabilities SQLI

The version of PHP installed on the remote host is prior to 8.5.9. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.5.9 advisory. - Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2...

ALSA-2026:48650 Important: vim security update

Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: Vim: Denial of Service via stack out-of-bounds write in spellsoundfoldsofo CVE-2026-57455 vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion CVE-2026-57456 vim: Vim:...

PHP 8.2.x < 8.2.33 Multiple Vulnerabilities SQLI

The version of PHP installed on the remote host is prior to 8.2.33. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.2.33 advisory. - Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8....