CVE-2026-62998

REDAXO is a PHP-based content management system. Prior to 5.21.2, rexlist::getSortColumn in redaxo/src/core/lib/list.php accepts the sort request parameter without checking whether setColumnSortable registered the requested column. An authenticated backend user can make prepareQuery add an escape...

CVE-2026-63002

REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the media filesystem into the Mediapool Sync page without rexescape. An attacker who can place an unregistered file with HTML metacharacters in th...

Improper Neutralization of Special Elements Used in a Template Engine

Overview solspace/craft-freeform is a flexible and user-friendly form building plugin! Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine via the rendering of submitted form field values in an isolated Twig context. An attacke...

CVE-2026-63000 REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates

REDAXO is a PHP-based content management system. Prior to 5.21.2, rexapiinstallpackageupdate in redaxo/src/addons/install/lib/api/apipackageupdate.php inherits the false default from rexapifunction::requiresCsrfProtection instead of requiring a CSRF token. An unauthenticated attacker can cause a...

CVE-2026-62998 REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration

REDAXO is a PHP-based content management system. Prior to 5.21.2, rexlist::getSortColumn in redaxo/src/core/lib/list.php accepts the sort request parameter without checking whether setColumnSortable registered the requested column. An authenticated backend user can make prepareQuery add an escape...

CVE-2026-62998 REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration

REDAXO is a PHP-based content management system. Prior to 5.21.2, rexlist::getSortColumn in redaxo/src/core/lib/list.php accepts the sort request parameter without checking whether setColumnSortable registered the requested column. An authenticated backend user can make prepareQuery add an escape...

CVE-2026-63002 REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames

REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the media filesystem into the Mediapool Sync page without rexescape. An attacker who can place an unregistered file with HTML metacharacters in th...

CVE-2026-63002 REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames

REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the media filesystem into the Mediapool Sync page without rexescape. An attacker who can place an unregistered file with HTML metacharacters in th...

WordPress Reycob Product Import Export plugin <= 2.3.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Reycob Product Import Export versions = 2.3.0...

php: PHP: Denial of Service via heap buffer overflow in SOAP client

A flaw was found in PHP. A malicious server can cause a Denial of Service DoS by exploiting an improper buffer size check in the Simple Object Access Protocol SOAP client during HTTP response parsing. When responding to a request, the server can supply crafted data that triggers an integer...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: php: php-8.5.11-2.hum1 aarch64, x8664 php-bcmath-8.5.11-2.hum1 aarch64, x8664 php-cli-8.5.11-2.hum1 aarch64, x8664 php-common-8.5.11-2.hum1 aarch64, x8664 php-dba-8.5.11-2.hum1 aarch64, x8664...

php: php: Information disclosure via crafted TLS server certificate

A flaw was found in PHP. When validating secure connections using Transport Layer Security TLS, an error in how wildcard domain names in server certificates are verified can lead to an out-of-bounds memory read. A malicious server presenting a specially crafted certificate can exploit this issue...

php: PHP: Denial of Service via reserved device names on Windows

A flaw was found in PHP. When running on Windows environments, PHP's filesystem and stream handlers fail to reject reserved system device names in file paths. An attacker who can control file or stream paths can supply these reserved names to open system devices instead of standard files. This ca...

php: php: Credential disclosure via cross-origin HTTP redirects

A flaw was found in PHP. When following a redirect, the built-in HTTP Hypertext Transfer Protocol stream wrapper forwards sensitive request headers—such as authentication tokens and session cookies—unchanged, even when directed to a different host, port, or unencrypted connection. A malicious...

php: php: Denial of Service via unbounded recursion in SOAP parser

A flaw was found in PHP. An unauthenticated remote attacker could cause a Denial of Service DoS by sending a specially crafted request to an affected Simple Object Access Protocol SOAP server endpoint. Due to a lack of recursion depth limits when parsing deeply nested XML elements, processing suc...

php: php: Out-of-bounds read via empty HTTP redirect Location header

A flaw was found in PHP. When the HTTP stream wrapper processes a redirect response containing an empty Location header, an out-of-bounds read occurs by accessing memory beyond the allocated buffer. A malicious server can exploit this flaw to influence the client's redirect target path, potential...

php: PHP: Archive entry injection via integer overflow in TAR parser

A flaw was found in PHP. An integer overflow vulnerability in the Phar extension occurs when parsing TAR archive headers containing excessively large size fields. An attacker can exploit this issue by supplying a specially crafted archive file to an application that processes TAR archives, causin...

php: php: Access control bypass via partial IPv6 address comparison

A flaw was found in PHP. The access control check for Internet Protocol version 6 IPv6 addresses in the FastCGI implementation compares only the first 12 bytes of a 16-byte address instead of the complete address. An attacker on an adjacent network with an address sharing the first 96 bits with a...

php: php: Server impersonation via Common Name fallback in TLS verification

A flaw was found in PHP. This vulnerability allows server impersonation and potential information disclosure during Transport Layer Security TLS connections. When verifying peer certificates, PHP improperly falls back to matching the Common Name CN if no Subject Alternative Name SAN matches the...

php: php: Denial of Service via out-of-bounds read in mysqlnd wire protocol parser

A flaw was found in PHP. The MySQL Native Driver mysqlnd wire protocol parser fails to verify that an incoming packet contains enough bytes before reading its fields. A malicious or compromised database server can send a truncated packet, causing the client application to read past the buffer...