Updated php packages fix security vulnerabilities

This update brings the latest version of php 8.2 and fixes some security vulnerabilities...

Critical: php

Issue Overview: Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9. CVE-2026-17543 Circular symbolic links in phar archives cou...

Security Bulletin: IBM Storage Protect Server is affected by a vulnerability in the netty-codec-http library.(CVE-2026-33870).

Summary IBM Storage Protect Server uses the netty-codec-http library in certain components. A vulnerability in netty could allow attacker to exploit the parsing flaw to craft requests that are interpreted differently by intermediaries and backend servers, resulting in HTTP request smuggling and...

CVE-2026-8763 Name Constraints bypass via trailing dot in rfc822Name and URI

In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...

Security Bulletin: IBM Storage Protect Server is susceptible to vulnerabilities due to Golang library related to ObjectAgent(CVE-2026-39824).

Summary Golang library is used by the IBM Storage Protect Server OSSM and ObjectAgent component. Golang is affected by multiple vulnerabilities that may cause data integrity issues, or memory handling problems when processing specially crafted input. This bulletin identifies the steps to address...

CVE-2026-7260

The CVE affects PHP’s phar handling, where circular symbolic links in phar archives can cause unbounded recursion, exhausting the C stack and crashing the PHP process. Affected versions are PHP 8.2.x before 8.2.33, 8.3.x before 8.3.33, 8.4.x before 8.4.24, and 8.5.x before 8.5.9. Root cause is un...

CLEANSTART-2026-AU09596 Security fixes in confluent-kafka 8.2.0-r0

Package confluent-kafka version 8.2.0-r0 fixes 7 vulnerabilities: CVE-2026-34477, CVE-2026-34478, CVE-2026-34479, CVE-2026-34480, CVE-2026-2332...

CVE-2026-12500 WP Travel Engine < 6.8.2 - Unauthenticated Trip Difficulty Level Option Update

The WP Travel Engine WordPress plugin before 6.8.2 does not perform a capability check on an AJAX action that updates a WP Travel Engine WordPress plugin before 6.8.2 option, allowing unauthenticated users to overwrite a site-wide WP Travel Engine WordPress plugin before 6.8.2 option the public...

CVE-2026-56390

GNU Bison is affected by CVE-2026-56390 through grammar-defined output directives (%output, %header), which can accept unrestricted file paths and override caller-supplied output options. When processing attacker-supplied grammar, this allows writing generated files to arbitrary writable location...

CVE-2026-56389

GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XML‑to‑HTML transformation step via %define tool.xsltproc, which is accepted without...

EUVD-2026-47420

Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications component: Security. Supported versions that are affected are 8.2 and 8.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP/IP to compromise Oracl...

EUVD-2026-47422

Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications component: Core. Supported versions that are affected are 8.2 and 8.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP/IP to compromise Oracle...

MiracleLinux 9 : php:8.2 (AXSA:2026-1328:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1328:01 advisory. PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions CVE-2026-7258 PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting...

CVE-2026-61225

Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications component: Core. Supported versions that are affected are 8.2 and 8.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP/IP to compromise Oracle...

CVE-2026-60282

...

PT-2026-63099

Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications component: Core. Supported versions that are affected are 8.2 and 8.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP/IP to compromise Oracle...

CVE-2026-39879 SQL injection in syslog-ng SQL destionation driver

Due to a missing sanitization call in afsqlddrunquery, syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This is not part of the default configuration, the SQL driver has to be manually configured. Fixes are in syslog-ng 4.12, syslog-ng Premium Edition 8.2 and...

JLSEC-2026-701

In wolfSSL 5.8.2 and earlier, a logic flaw existed in the TLS 1.2 server state machine implementation. The server could incorrectly accept the CertificateVerify message before the ClientKeyExchange message had been received. This issue affects wolfSSL before 5.8.4 wolfSSL 5.8.2 and earlier is...

CVE-2026-57167

PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, server-side-rendered video watch pages embed a schema.org JSON-LD block by JSON.stringify-ing video metadata without escaping less-than, greater-than, or slash characters, allowing a value containing the byte sequence...

CVE-2026-57167 PeerTube: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, server-side-rendered video watch pages embed a schema.org JSON-LD block by JSON.stringify-ing video metadata without escaping less-than, greater-than, or slash characters, allowing a value containing the byte sequence...