Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)

Summary Pimcore\Model\DataObject\ClassDefinition\Data\Hotspotimage::getDataFromResource deserializes the hotspots object-store column through the Pimcore\Tool\Serialize::unserialize wrapper without a class allowlist the wrapper's $allowedClasses parameter defaults to true, i.e. fully unrestricted...

CVE-2026-67355

A flaw was found in guzzlehttp/guzzle. The software does not correctly enforce the "host-only" scope for cookies, which means it stores the request host in the cookie's domain field instead of restricting the cookie to the exact host. This vulnerability could allow an attacker who controls a...

CVE-2026-67339

A flaw was found in guzzlehttp/guzzle, where it fails to properly isolate Proxy-Authorization headers from origin servers when using cURL handlers. A remote attacker could exploit this vulnerability when requests are redirected, bypassed, or sent through SOCKS proxies that Guzzle misclassifies as...

CVE-2026-67354

A flaw was found in guzzlehttp/guzzle. This vulnerability, located in the RedirectMiddleware, can lead to information disclosure. When the optional allowredirects.referer setting is enabled, the middleware copies the URI fragment the portion after '' from a referring request into the generated...

CVE-2026-67353

A flaw was found in guzzlehttp/guzzle. A remote attacker can exploit this vulnerability by sending an excessive number of large 'Set-Cookie' header fields from a malicious server. This causes the application's CookieJar to store an unbounded amount of data in memory, leading to resource exhaustio...

CLSA-2026-1786546010 TuxCare security update for guzzlehttp/guzzle (2 CVEs)

TuxCare rebuilt guzzlehttp/guzzle to address 2 CVEs. Fixed in 7.10.0-p3+tuxcare...

CLSA-2026-1784856237 TuxCare security update for guzzlehttp/guzzle (9 CVEs)

TuxCare rebuilt guzzlehttp/guzzle to address 9 CVEs. Fixed in 7.10.0-p2+tuxcare...

CLSA-2026-1783386132 TuxCare security update for guzzlehttp/guzzle (2 CVEs)

TuxCare rebuilt guzzlehttp/guzzle to address 2 CVEs. Fixed in 6.0.2-p1+tuxcare...

CLSA-2026-1783645385 TuxCare security update for guzzlehttp/guzzle (1 CVE)

TuxCare rebuilt guzzlehttp/guzzle to address 1 CVE. Fixed in 6.0.2-p2+tuxcare...

CLSA-2026-1779065200 TuxCare security update for guzzlehttp/guzzle (5 CVEs)

TuxCare rebuilt guzzlehttp/guzzle to address 5 CVEs. Fixed in 6.3.3-p1+tuxcare...

Incorrect Behavior Order: Validate Before Canonicalize

Overview Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize via the request URI handling. An attacker can access resources on hosts that should have been excluded by bypassing host-based access controls through manipulation of noncanonical...

Linux Distros Unpatched Vulnerability : CVE-2026-69245

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, SetCookie::matchesDomain gives every subdomain of a cookie Domain that cookie unless...

Linux Distros Unpatched Vulnerability : CVE-2026-69246

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the request URI as text and supplies the Host header separately. Th...

DEBIAN-CVE-2026-69246

Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the request URI as text and supplies the Host header separately. The cURL handlers set CURLOPTURL to the URI exactly as written and push that Host into CURLOPTHTTPHEADER; StreamHandler does the same throu...

CVE-2026-69245

Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, SetCookie::matchesDomain gives every subdomain of a cookie Domain that cookie unless SetCookie::matchesDomain recognizes the Domain as an IP literal or a numeric host, and the decision comes from the domain's own text, so two...

CVE-2026-69246

Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the request URI as text and supplies the Host header separately. The cURL handlers set CURLOPTURL to the URI exactly as written and push that Host into CURLOPTHTTPHEADER; StreamHandler does the same throu...

DEBIAN-CVE-2026-69245

Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, SetCookie::matchesDomain gives every subdomain of a cookie Domain that cookie unless SetCookie::matchesDomain recognizes the Domain as an IP literal or a numeric host, and the decision comes from the domain's own text, so two...

UBUNTU-CVE-2026-69245

Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, SetCookie::matchesDomain gives every subdomain of a cookie Domain that cookie unless SetCookie::matchesDomain recognizes the Domain as an IP literal or a numeric host, and the decision comes from the domain's own text, so two...

UBUNTU-CVE-2026-69246

Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the request URI as text and supplies the Host header separately. The cURL handlers set CURLOPTURL to the URI exactly as written and push that Host into CURLOPTHTTPHEADER; StreamHandler does the same throu...

EUVD-2026-52445

Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the request URI as text and supplies the Host header separately. The cURL handlers set CURLOPTURL to the URI exactly as written and push that Host into CURLOPTHTTPHEADER; StreamHandler does the same throu...