285 matches found
UBUNTU-CVE-2026-86431
league/commonmark thephpleague/commonmark versions = 2.7.0 and 2.9.1 contain a cross-site scripting vulnerability in the AttributesExtension. Prefixing an attribute name with a single U+000C form feed byte e.g. \x0Conclick="alert1" bypasses the AttributesHelper::filterAttributes 'on' event-handle...
UBUNTU-CVE-2026-86430
league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on crafted input. Attackers can submit specially crafted Markdown with long...
CVE-2026-86431
league/commonmark thephpleague/commonmark versions = 2.7.0 and 2.9.1 contain a cross-site scripting vulnerability in the AttributesExtension. Prefixing an attribute name with a single U+000C form feed byte e.g. \x0Conclick="alert1" bypasses the AttributesHelper::filterAttributes 'on' event-handle...
CVE-2026-86429
The league/commonmark thephpleague/commonmark library in versions = 1.5.0 and 2.9.1 contains quadratic parsing complexity in its SmartPunctExtension and AttributesExtension. When either extension is explicitly registered on the Environment they are not enabled by default and are excluded from the...
CGA-2PHP-XFR5-32X4
Bulletin has no description...
CLSA-2026-1788348158 TuxCare security update for firebase/php-jwt (1 CVE)
TuxCare rebuilt firebase/php-jwt to address 1 CVE. Fixed in v5.5.1-p1+tuxcare...
GHSA-JJV6-8J6V-6J52 league/commonmark: Denial of service in the SmartPunct and Attributes extensions
Impact Two first-party extensions contain quadratic parsing paths. Both ship with the library but must be explicitly registered on the Environment; neither is included in CommonMarkConverter, GithubFlavoredMarkdownConverter, or GithubFlavoredMarkdownExtension. Applications that do not register...
CVE-2026-84308
phpseclib is a PHP secure communications library. Prior to 3.0.57 and 4.0.1, pure-PHP X25519 scalar multiplication in phpseclib/Math/PrimeField/Integer.php performs data-dependent conditional modular reductions in add and subtract. During the Montgomery ladder in...
UBUNTU-CVE-2026-84308
phpseclib is a PHP secure communications library. Prior to 3.0.57 and 4.0.1, pure-PHP X25519 scalar multiplication in phpseclib/Math/PrimeField/Integer.php performs data-dependent conditional modular reductions in add and subtract. During the Montgomery ladder in...
RHSA-2026:61259 Red Hat Security Advisory: php security, bug fix, and enhancement update
Bulletin has no description...
DEBIAN-CVE-2026-81525
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations...
CVE-2026-81525
Removed by vendor...
Improper Input Validation
Overview vrana/adminer is a Database management in a single file. Affected versions of this package are vulnerable to Improper Input Validation via the X-Forwarded-Prefix header. An attacker can manipulate redirect destinations, control the session cookie path attribute, and poison self-referenti...
CLSA-2026-1787223739 TuxCare security update for dompdf/dompdf (6 CVEs)
TuxCare rebuilt dompdf/dompdf to address 6 CVEs. Fixed in 1.2.2-p2+tuxcare...
CLSA-2026-1787221779 TuxCare security update for zendframework/zendframework1 (1 CVE)
TuxCare rebuilt zendframework/zendframework1 to address 1 CVE. Fixed in 1.10.6-p2+tuxcare...
Information Exposure
Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Information Exposure via the pdf.php endpoint. An attacker can access sensitive metadata, including titles, solution IDs, author names, and last-update...
Missing Authorization
Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Missing Authorization through the register API endpoint. An attacker can create unauthorized user accounts by sending crafted requests to the affected A...
CLSA-2026-1787157563 TuxCare security update for zendframework/zendframework1 (23 CVEs)
TuxCare rebuilt zendframework/zendframework1 to address 23 CVEs. Fixed in 1.10.6-p1+tuxcare...
CVE-2026-49289
The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. In 4.19.2 and 4.20.2, the library permits attacker-controlled XPath transforms while processing XML signatures in specially crafted SAML messages. XPath evaluation can consume uncontrolled processing resources,...