378 matches found
PT-2026-90598
Name of the Vulnerable Software and Affected Versions Tutor LMS versions prior to 4.0.8 Description The Tutor LMS plugin for WordPress is affected by a PHP Object Injection issue that can lead to remote code execution on over 100,000 sites worldwide. The flaw exists in the tutor save withdraw...
CLSA-2026-1788433786 TuxCare security update for guzzlehttp/guzzle (11 CVEs)
TuxCare rebuilt guzzlehttp/guzzle to address 11 CVEs. Fixed in 6.0.2-p5+tuxcare...
CLSA-2026-1788269522 TuxCare security update for guzzlehttp/guzzle (7 CVEs)
TuxCare rebuilt guzzlehttp/guzzle to address 7 CVEs. Fixed in 6.3.3-p3+tuxcare...
Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)
Summary Pimcore\Model\DataObject\ClassDefinition\Data\Hotspotimage::getDataFromResource deserializes the hotspots object-store column through the Pimcore\Tool\Serialize::unserialize wrapper without a class allowlist the wrapper's $allowedClasses parameter defaults to true, i.e. fully unrestricted...
CVE-2026-67355
A flaw was found in guzzlehttp/guzzle. The software does not correctly enforce the "host-only" scope for cookies, which means it stores the request host in the cookie's domain field instead of restricting the cookie to the exact host. This vulnerability could allow an attacker who controls a...
CVE-2026-67339
A flaw was found in guzzlehttp/guzzle, where it fails to properly isolate Proxy-Authorization headers from origin servers when using cURL handlers. A remote attacker could exploit this vulnerability when requests are redirected, bypassed, or sent through SOCKS proxies that Guzzle misclassifies as...
CVE-2026-67354
A flaw was found in guzzlehttp/guzzle. This vulnerability, located in the RedirectMiddleware, can lead to information disclosure. When the optional allowredirects.referer setting is enabled, the middleware copies the URI fragment the portion after '' from a referring request into the generated...
CVE-2026-67353
A flaw was found in guzzlehttp/guzzle. A remote attacker can exploit this vulnerability by sending an excessive number of large 'Set-Cookie' header fields from a malicious server. This causes the application's CookieJar to store an unbounded amount of data in memory, leading to resource exhaustio...
CLSA-2026-1787819618 TuxCare security update for guzzlehttp/guzzle (3 CVEs)
TuxCare rebuilt guzzlehttp/guzzle to address 3 CVEs. Fixed in 6.5.8-p3+tuxcare...
CLSA-2026-1786546010 TuxCare security update for guzzlehttp/guzzle (2 CVEs)
TuxCare rebuilt guzzlehttp/guzzle to address 2 CVEs. Fixed in 7.10.0-p3+tuxcare...
PT-2026-80120
TuxCare rebuilt guzzlehttp/guzzle to address 2 CVEs. Fixed in 7.10.0-p3+tuxcare...
CLSA-2026-1786439704 TuxCare security update for guzzlehttp/guzzle (6 CVEs)
TuxCare rebuilt guzzlehttp/guzzle to address 6 CVEs. Fixed in 6.3.3-p2+tuxcare...
PT-2026-80074
TuxCare rebuilt guzzlehttp/guzzle to address 6 CVEs. Fixed in 6.3.3-p2+tuxcare...
CLSA-2026-1785380980 TuxCare security update for guzzlehttp/guzzle (2 CVEs)
TuxCare rebuilt guzzlehttp/guzzle to address 2 CVEs. Fixed in 6.0.2-p4+tuxcare...
CLSA-2026-1784856237 TuxCare security update for guzzlehttp/guzzle (9 CVEs)
TuxCare rebuilt guzzlehttp/guzzle to address 9 CVEs. Fixed in 7.10.0-p2+tuxcare...
CLSA-2026-1784164044 TuxCare security update for guzzlehttp/guzzle (2 CVEs)
TuxCare rebuilt guzzlehttp/guzzle to address 2 CVEs. Fixed in 6.5.8-p1+tuxcare...
CLSA-2026-1783991062 TuxCare security update for guzzlehttp/guzzle (3 CVEs)
TuxCare rebuilt guzzlehttp/guzzle to address 3 CVEs. Fixed in 6.0.2-p3+tuxcare...
CLSA-2026-1783645388 TuxCare security update for guzzlehttp/guzzle (2 CVEs)
TuxCare rebuilt guzzlehttp/guzzle to address 2 CVEs. Fixed in 7.10.0-p1+tuxcare...