CVE-2026-76174

Unrestricted file upload vulnerability in the CSV file upload functionality of the Ocsreports admininfo endpoint. The application validates files solely based on the name provided by the client, without properly checking their content or securely restricting the permitted file types. This allows ...

DEBIAN-CVE-2026-76174

Unrestricted file upload vulnerability in the CSV file upload functionality of the Ocsreports admininfo endpoint. The application validates files solely based on the name provided by the client, without properly checking their content or securely restricting the permitted file types. This allows ...

php security, bug fix, and enhancement update

An update is available for php. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list PHP is an HTML-embedded scripting language commonly used with the Apache HTTP...

RLSA-2026:62614 Important: php security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archives CVE-2026-7260 Bug Fixes and Enhancements...

WordPress JobSearch plugin <= 3.2.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Phat RiO in WordPress Plugin JobSearch versions = 3.2.0...

Exploit for CVE-2026-13001

CVE-2026-13001 — Podlove Podcast Publisher Unauthenticated File...

RHSA-2026:62614 Red Hat Security Advisory: php security, bug fix, and enhancement update

Bulletin has no description...

CVE-2026-76174

Ocsreports for OCS Inventory NG has an unrestricted file upload vulnerability in the CSV file upload functionality of the admin_info endpoint . The application validates files solely by the client-provided name, without inspecting content or restricting permitted file types. An administrator user...

EUVD-2026-70368

Unrestricted file upload vulnerability in the CSV file upload functionality of the Ocsreports admininfo endpoint. The application validates files solely based on the name provided by the client, without properly checking their content or securely restricting the permitted file types. This allows ...

PT-2026-85119

Unauthenticated PHP Object Injection in JobSearch = 3.2.0 versions...

Oracle Linux 9 : ELSA-2026-61903-0: / php:8.2 (ELSA-2026-619030)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-619030 advisory. php 8.2.33-1 - rebase to 8.2.33 php-pecl-apcu 5.1.23-1 - update to 5.1.23 for PHP 8.2 RHEL-14699 php-pecl-rrd 2.0.3-4 - build for PHP 8.1 2070040...

MiracleLinux 9 : php:8.2 (AXSA:2026-1748:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1748:01 advisory. php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar...

Oracle Linux 10 : ELSA-2026-62614-0: / php (ELSA-2026-626140)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-626140 advisory. 8.3.33-1 - rebase to 8.3.33 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus...

RockyLinux 10 : php (RLSA-2026:62614)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:62614 advisory. php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar...

AlmaLinux 10 : php (ALSA-2026:62614)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:62614 advisory. php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archiv...

Linux Distros Unpatched Vulnerability : CVE-2026-84308

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - phpseclib is a PHP secure communications library. Prior to 3.0.57 and 4.0.1, pure-PHP X25519 scalar multiplication in phpseclib/Math/PrimeField/Integer.php...

Linux Distros Unpatched Vulnerability : CVE-2026-84372

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 until version 3.3.0, pipeline handling on aggregate cluster an...

CGA-2PHP-XFR5-32X4

Bulletin has no description...

CVE-2026-82524 UnoPim File Upload RCE via TinyMCE Image Upload Endpoint

UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated administrators to upload arbitrary PHP files through the TinyMCE image upload endpoint due to missing file extension and MIME type validation. Attackers can upload a PHP web shell to the public stora...

EUVD-2026-70265

UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated administrators to upload arbitrary PHP files through the TinyMCE image upload endpoint due to missing file extension and MIME type validation. Attackers can upload a PHP web shell to the public stora...