Security update for php8

This update for php8 fixes the following issues: Update to version 8.3.33. Security issues fixed: CVE-2026-7260: circular symbolic links in phar archives can lead to unbounded recursion and cause C stack exhaustion bsc1273077. CVE-2026-9672: security issues in libgd bsc1273078. CVE-2026-17543:...

SUSE-SU-2026:3509-1 Security update for php8

This update for php8 fixes the following issues: Update to version 8.3.33. Security issues fixed: - CVE-2026-7260: circular symbolic links in phar archives can lead to unbounded recursion and cause C stack exhaustion bsc1273077. - CVE-2026-9672: security issues in libgd bsc1273078. -...

Malicious code in devplatform-react-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 422556511a13a0424a33cfdb404a289d3fd51a0f7f206b4de8114fe69a0874b6 On require'devplatform-react-form', index.js loads adapter.js which fetches a platform-specific native binary from hardcoded Cloudflare Workers...

Malicious code in opencode-engos-ai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42180a034d43d3c6d16e223fe6fcd93f6e403f0c73c763e9b21b6aded0545274 On npm install, postinstall.mjs enumerates platform-specific sibling package names of the form opencode-engos---baseline-musl, resolves each to the...

CVE-2026-71254

creationtimestamp| type| source ---|---|--- 2026-08-05 12:00:30+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3msdi4bhzi62l 2026-08-05 12:00:31+00:00| seen| https://infosec.exchange/users/offseq/statuses/117042788884411144 2026-08-05 12:40:04+00:00| seen|...

CVE-2026-10090

creationtimestamp| type| source ---|---|--- 2026-08-05 10:18:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/gzht5h26j6cgw 2026-08-05 10:22:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msdcme5m4p2o 2026-08-05 11:31:08+00:00| seen|...

UBUNTU-CVE-2026-64574

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: tear down new links on vif update error path When ieee80211vifupdatelinks adds new links it allocates a link container for each and calls ieee80211linkinit which registers the per-link debugfs files with...

EUVD-2026-53268

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: tear down new links on vif update error path When ieee80211vifupdatelinks adds new links it allocates a link container for each and calls ieee80211linkinit which registers the per-link debugfs files with...

CVE-2026-5062

The PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin plugin for WordPress is vulnerable to SQL Injection via the 's' search parameter on the Pretty Links listing page in all versions up to, and including, 3.6.20. This is due to insufficient escapin...

CVE-2026-5062

CVE-2026-5062 affects PrettyLinks (WordPress plugin) versions up to and including 3.6.20. The vulnerability is an SQL injection via the 's' (search) parameter on the Pretty Links listing page, caused by insufficient escaping and lack of proper prepared statements in search_links_table(). It requi...

Link following vulnerability allows arbitrary file creation

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives. This allows attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary...

EUVD-2026-52869

SNOMED International Snowstorm contains a reflected XSS vulnerability within the "Web Route" redirection functionality. An attacker can inject arbitrary JavaScript which will execute upon a target user navigating to a crafted, malicious link. Fixed in 10.12.2 and 10.9.3...

Cross-site Scripting (XSS)

Overview Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the displayforfield function. An attacker can execute arbitrary JavaScript code in the context of th...

K000162775: PHP Phar vulnerability CVE-2026-7260

Security Advisory Description Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9. CVE-2026-7260 Impac...

CVE-2026-15920 Potential cross-site scripting via URLField values in the admin

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.displayforfield renders URLField values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin...

CVE-2026-14804

creationtimestamp| type| source ---|---|--- 2026-08-04 10:24:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/7yueqk4ra6t2i 2026-08-04 10:30:28+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3msasmexj4i2b 2026-08-04 10:30:35+00:00| seen|...

EUVD-2026-52490

A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code with elevated privileges by inducing an operator to connect the sensor to an attacker-controlled host...

Critical: php8.3

Issue Overview: Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9. CVE-2026-17543 Circular symbolic links in phar archives cou...

Critical: php8.4

Issue Overview: Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9. CVE-2026-17543 Attacker-provided inputs to bccomp could lea...

Amazon Linux 2023 : php8.4, php8.4-bcmath, php8.4-cli (ALAS2023-2026-2042)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2042 advisory. Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24...