php: PHP: Archive entry injection via integer overflow in TAR parser

A flaw was found in PHP. An integer overflow vulnerability in the Phar extension occurs when parsing TAR archive headers containing excessively large size fields. An attacker can exploit this issue by supplying a specially crafted archive file to an application that processes TAR archives, causin...

EUVD-2026-84963

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a local attacker to gain unauthorized access to sensitive information and modify transaction data due to the use of hard-coded credentials...

PT-2026-97363

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description Remote attackers can manipulate database queries because the software fails to properly neutralize special elements within a boolean...

CVE-2026-17644 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a local attacker to gain unauthorized access to sensitive information and modify transaction data due to the use of hard-coded credentials...

OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack

Impact When running in the highly privileged recovery mode, OpenBao was vulnerable to a timing attack against the single recovery token. This allowed an attacker to extract the recovery token and use it to perform operations against the OpenBao instance, including reading or modification of data...

EUVD-2026-84538

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu integration mutation use cases including remove-integration, update-integration, auto-configure-integration, and set-integration-as-primary look up an integration by integrationId and organizationId...

PT-2026-96646

Name of the Vulnerable Software and Affected Versions CMP – Coming Soon & Maintenance Plugin by NiteoThemes versions prior to 4.1.18 Description An issue exists where a missing capability check on the 'cmp ajax import settings' AJAX action allows authenticated attackers with Editor-level access o...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: php (UTSA-2023-002406)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002406 advisory. In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function allocate buffer one byte too small. When resolving paths with...

CVE-2026-83621

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, POST /lua/rest/v2/edit/system/editblacklist.lua in scripts/lua/rest/v2/edit/system/editblacklist.lua lacks an administrator check and calls listsutils.editList for any authenticated user. The listname, listenabled,...

PT-2026-96301

Name of the Vulnerable Software and Affected Versions Chartbrew versions prior to 5.2.2 Description The runQuery function in server/modules/ai/orchestrator/tools/runQuery.js fails to perform runtime integer validation on the row limit parameter before interpolating it into a SQL LIMIT clause...

CVE-2026-15947

The Metasync plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveinstantindexingsettings function in versions up to, and including, 2.6.23. This function is registered on the admininit hook and only checks for the presence of...

CVE-2026-2278

The VW Writer Blog theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'vwwriterblogresetallsettings' function in all versions up to, and including, 1.3.8. This makes it possible for authenticated attackers, with Subscriber-level access...

EUVD-2026-83572

The Metasync plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveinstantindexingsettings function in versions up to, and including, 2.6.23. This function is registered on the admininit hook and only checks for the presence of...

CVE-2026-92421: Authorization Bypass Through User-Controlled Key

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modified belongs to the user making the request, allowing authenticated users holding a Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin...

PT-2026-95782

Name of the Vulnerable Software and Affected Versions Metasync versions prior to 2.6.24 Description The Metasync plugin for WordPress allows unauthorized modification of data because the save instant indexing settings function lacks a capability check. The function is registered on the admin init...

EUVD-2026-82495

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 2.4.5. This is due to the plugin accepting a client-supplied package-redemption identifier as proof of payment without validating...

Cisco Identity Services Engine Multiple Vulnerabilities (cisco-sa-ise-sql-inj-3QTKR947)

According to its self-reported version, Cisco ISE is affected by multiple vulnerabilities. - A vulnerability in Cisco ISE could allow an unauthenticated, remote attacker to conduct SQL injection attacks on an affected device. This vulnerability is due to improper validation of user-supplied input...

CVE-2026-16582

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 2.4.5. This is due to the plugin accepting a client-supplied package-redemption identifier as proof of payment without validating...

CVE-2026-92949

A flaw was found in vm2, a JavaScript sandbox. This vulnerability allows sandboxed scripts to bypass security protections, specifically vm.freeze and vm.readonly, which are designed to prevent unauthorized modifications to objects. An attacker can exploit this by directly accessing and invoking...

PT-2026-95132

Name of the Vulnerable Software and Affected Versions Booking for Appointments and Events Calendar – Amelia versions prior to 2.4.6 Description The plugin allows unauthenticated attackers to create approved appointment bookings without completing payment. This occurs because the software accepts ...