CVE-2026-84752 WordPress RTMKit plugin <= 2.1.5 - PHP Object Injection vulnerability

Contributor PHP Object Injection in RTMKit = 2.1.5 versions...

EUVD-2026-70590

Contributor PHP Object Injection in RTMKit = 2.1.5 versions...

DEBIAN-CVE-2026-76174

Unrestricted file upload vulnerability in the CSV file upload functionality of the Ocsreports admininfo endpoint. The application validates files solely based on the name provided by the client, without properly checking their content or securely restricting the permitted file types. This allows ...

CVE-2026-76174

Unrestricted file upload vulnerability in the CSV file upload functionality of the Ocsreports admininfo endpoint. The application validates files solely based on the name provided by the client, without properly checking their content or securely restricting the permitted file types. This allows ...

php security, bug fix, and enhancement update

An update is available for php. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list PHP is an HTML-embedded scripting language commonly used with the Apache HTTP...

RLSA-2026:62614 Important: php security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archives CVE-2026-7260 Bug Fixes and Enhancements...

miniOrange SAML SSO Auth Bypass RCE (CVE-2026-15013)

Exploits CVE-2026-15013 in miniOrange SAML SSO = 5.4.3: HMAC signature algorithm confusion in SAML assertion validation lets an unauthenticated attacker forge a signed assertion using the IdP X509 public key as the HMAC secret. Enumerates WordPress users, obtains admin via forged SAMLResponse,...

WordPress JobSearch plugin <= 3.2.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Phat RiO in WordPress Plugin JobSearch versions = 3.2.0...

WordPress Mail Mint plugin <= 1.31.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by endy in WordPress Plugin Mail Mint versions = 1.31.0...

Exploit for CVE-2026-13001

CVE-2026-13001 — Podlove Podcast Publisher Unauthenticated File...

RHSA-2026:62614 Red Hat Security Advisory: php security, bug fix, and enhancement update

Bulletin has no description...

CVE-2026-76174

Unrestricted file upload vulnerability in the CSV file upload functionality of the Ocsreports admininfo endpoint. The application validates files solely based on the name provided by the client, without properly checking their content or securely restricting the permitted file types. This allows ...

EUVD-2026-70368

Unrestricted file upload vulnerability in the CSV file upload functionality of the Ocsreports admininfo endpoint. The application validates files solely based on the name provided by the client, without properly checking their content or securely restricting the permitted file types. This allows ...

CVE-2026-76174 Multiple vulnerabilities in Ocsreports for OCS Inventory NG

Unrestricted file upload vulnerability in the CSV file upload functionality of the Ocsreports admininfo endpoint. The application validates files solely based on the name provided by the client, without properly checking their content or securely restricting the permitted file types. This allows ...

CVE-2026-76174

Ocsreports for OCS Inventory NG has an unrestricted file upload vulnerability in the CSV file upload functionality of the admin_info endpoint . The application validates files solely by the client-provided name, without inspecting content or restricting permitted file types. An administrator user...

secbench-dvwa

DAMN VULNERABLE WEB APPLICATION Damn Vulnerable Web Applicati...

MiracleLinux 9 : php:8.2 (AXSA:2026-1748:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1748:01 advisory. php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar...

Oracle Linux 10 : ELSA-2026-62614-0: / php (ELSA-2026-626140)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-626140 advisory. 8.3.33-1 - rebase to 8.3.33 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus...

CVE-2026-84752: Deserialization of Untrusted Data

Contributor PHP Object Injection in RTMKit = 2.1.5 versions...

CVE-2026-77999: External Control of Assumed-Immutable Web Parameter

Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - The PayPal IPN listener's signature check validateIPN accepted UNVERIFIED and any non-INVALID response as valid, made its verificati...