Important: php:7.4 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archives CVE-2026-7260 Bug Fixes and Enhancements...

MiracleLinux 9 : php-8.0.30-8.el9_8 (AXSA:2026-1720:03)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1720:03 advisory. php: ext/openssl: memory corruption in opensslencrypt with AES-WRAP-PAD CVE-2026-14355 php: ext-pgsql: PHP: SQL injection via improper backslash...

AlmaLinux 9 : php:8.2 (ALSA-2026:61903)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:61903 advisory. php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archive...

RHEL 9 : php:8.2 (RHSA-2026:61903)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:61903 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext-pgsql: PHP: SQL injection vi...

AlmaLinux 9 : php (ALSA-2026:61259)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:61259 advisory. php: ext/openssl: memory corruption in opensslencrypt with AES-WRAP-PAD CVE-2026-14355 php: ext-pgsql: PHP: SQL injection via improper backslash escaping...

PT-2026-84465

Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the back query GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payloa...

ALSA-2026:62334 Important: php:7.4 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archives CVE-2026-7260 Bug Fixes and Enhancements...

CVE-2026-82394

Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the preview-link endpoint and src/Sulu/Bundle/PreviewBundle/Application/Manager/PreviewLinkManager.php do not enforce VIEW permission for the target resource in...

CVE-2026-82396 Sulu: Stored XSS via media download inline-disposition override

Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, src/Sulu/Bundle/MediaBundle/Controller/MediaStreamController.php allows the /media/id/download/slug route and its administration variant to honor the inline query parameter for...

CVE-2026-82226

Unauthenticated PHP Object Injection in Tickera = 3.6.0.2 versions...

CVE-2026-81891

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, checkExtractItems in php/elFinderVolumeDriver.class.php calls mimetypeInternalDetect without passing the result through mimeTypeNormalize. Because the .phtml, .phar, .php5, and .php3 extension...

CVE-2026-82394

Sulu , an open-source PHP CMS built on Symfony , contains an authorization bypass in its preview-link functionality. Prior to versions 2.6.25 and 3.0.8 , the methods PreviewLinkManager::generate() and PreviewLinkManager::revoke() fail to enforce the VIEW permission on the target resource. An auth...

CVE-2026-62993

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. Prior to 4.5.7 and 5.8.2, depending on the release line, Smarty's fetch handling in libs/plugins/function.fetch.php and src/FunctionHandler/Fetch.php used Security::isTrustedUri to...

CVE-2026-62993 Smarty: SSRF via redirect bypass of trusted_uri using {fetch}

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. Prior to 4.5.7 and 5.8.2, depending on the release line, Smarty's fetch handling in libs/plugins/function.fetch.php and src/FunctionHandler/Fetch.php used Security::isTrustedUri to...

CVE-2026-62993 Smarty: SSRF via redirect bypass of trusted_uri using {fetch}

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. Prior to 4.5.7 and 5.8.2, depending on the release line, Smarty's fetch handling in libs/plugins/function.fetch.php and src/FunctionHandler/Fetch.php used Security::isTrustedUri to...

CVE-2026-81891

elFinder (open-source web file manager) is vulnerable to remote code execution prior to version 2.1.70 . The flaw resides in checkExtractItems() in php/elFinderVolumeDriver.class.php, which calls mimetypeInternalDetect() without passing the result through mimeTypeNormalize(). Because the .phtml, ...

CVE-2026-82226

This CVE affects the Tickera (Event Ticketing System) WordPress plugin, versions 3.6.0.2 and below . The vulnerability is an unauthenticated PHP Object Injection , rated CVSS 9.8 (Critical) with a network attack vector requiring no privileges or user interaction, and high impact on confidentialit...

CVE-2026-82226 WordPress Tickera plugin <= 3.6.0.2 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Tickera = 3.6.0.2 versions...

EUVD-2026-68796

Unauthenticated PHP Object Injection in Tickera = 3.6.0.2 versions...

GHSA-8X3Q-JPJH-QH5C elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback

poc.zip Summary elFinder 2.1.69 is vulnerable to a Server-Side Request Forgery SSRF protection bypass when PHP cURL is unavailable and URL uploads use the fsockgetcontents fallback. An attacker who can submit a URL for server-side upload can use an attacker-controlled DNS hostname that initially...