CVE-2026-81772 WordPress Ninja Forms - Layout & Styles plugin <= 3.0.31 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Ninja Forms - Layout & Styles = 3.0.31 versions...

CVE-2026-81283 WordPress WP User Frontend plugin <= 4.3.10 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in WP User Frontend = 4.3.10 versions...

CVE-2026-81283 WordPress WP User Frontend plugin <= 4.3.10 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in WP User Frontend = 4.3.10 versions...

CVE-2026-81283

WP User Frontend is a WordPress plugin affected by a PHP Object Injection vulnerability in versions 4.3.10 and below . The vulnerability requires low privileges (subscriber-level access), no user interaction, and a low attack complexity, making it accessible to any authenticated subscriber on a s...

EUVD-2026-69922

Subscriber PHP Object Injection in WP User Frontend = 4.3.10 versions...

CLSA-2026-1788348158 TuxCare security update for firebase/php-jwt (1 CVE)

TuxCare rebuilt firebase/php-jwt to address 1 CVE. Fixed in v5.5.1-p1+tuxcare...

WordPress RTMKit plugin <= 2.1.5 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by daroo in WordPress Plugin RTMKit versions = 2.1.5...

RHSA-2026:62334 Red Hat Security Advisory: php:7.4 security, bug fix, and enhancement update

Bulletin has no description...

RHSA-2026:61903 Red Hat Security Advisory: php:8.2 security, bug fix, and enhancement update

Bulletin has no description...

CVE-2026-19116

The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing authenticated users with subscriber-level access and above to perform PHP Object Injection, which may lead ...

RLSA-2026:61903 Important: php:8.2 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archives CVE-2026-7260 Bug Fixes and Enhancements...

php:8.2 security, bug fix, and enhancement update

An update is available for php, module.php-pecl-rrd, php-pecl-apcu, module.php-pecl-apcu, php-pecl-zip, php-pecl-rrd, module.php, module.php-pecl-zip, php-pecl-xdebug3, module.php-pecl-xdebug3. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a...

RLSA-2026:62334 Important: php:7.4 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archives CVE-2026-7260 Bug Fixes and Enhancements...

php:7.4 security, bug fix, and enhancement update

An update is available for module.php-pecl-xdebug, module.libzip, php, module.php-pecl-rrd, php-pecl-apcu, module.php-pecl-apcu, libzip, php-pecl-zip, php-pecl-rrd, module.php, php-pecl-xdebug, php-pear, module.php-pear, module.php-pecl-zip. This update affects Rocky Linux 8. A Common Vulnerabili...

EUVD-2026-69865

The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing authenticated users with subscriber-level access and above to perform PHP Object Injection, which may lead ...

CVE-2026-19116 WP User Frontend < 4.3.11 - Subscriber+ PHP Object Injection via Frontend Post Edit Form

The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing authenticated users with subscriber-level access and above to perform PHP Object Injection, which may lead ...

CVE-2026-19116

The User Frontend WordPress plugin before version 4.3.11 is vulnerable to PHP Object Injection because it fails to prevent the deserialization of user-supplied field values. This occurs when a submitted post is reopened within its frontend editing form. Attackers with subscriber-level access or h...

CVE-2026-19116 WP User Frontend < 4.3.11 - Subscriber+ PHP Object Injection via Frontend Post Edit Form

The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing authenticated users with subscriber-level access and above to perform PHP Object Injection, which may lead ...

EUVD-2026-69794

A security vulnerability has been detected in gouguoa up to 5.10.0/6.0.1. This vulnerability affects the function update of the file app/home/controller/Index.php of the component editpersonal Endpoint. Such manipulation of the argument positionid leads to dynamically-determined object attributes...

CVE-2026-84430

gouguoa versions up to 5.10.0/6.0.1 contain a vulnerability in the edit_personal Endpoint (file app/home/controller/Index.php, function update). Manipulation of the position_id argument leads to dynamically-determined object attributes , enabling remote exploitation. The exploit has been publicly...