CVE-2026-52608

The software reportico-web (version

PT-2026-77231

Name of the Vulnerable Software and Affected Versions reportico-web versions prior to 8.1.1 Description A directory traversal issue allows remote attackers to expose or execute arbitrary PHP files on the web server. This occurs when a filename is specified in the target format parameter while usi...

Fedora 44 : php-phpseclib (2026-fac5581caa)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-fac5581caa advisory. Update to v2.0.55 - contains fix for CVE-2026-44167 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note th...

Fedora 43 : php-phpseclib (2026-b2ce3f8e3e)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-b2ce3f8e3e advisory. Update to v2.0.55 - contains fix for CVE-2026-44167 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note th...

CVE-2026-45117: Improper Control of Generation of Code

MyBB is free and open source forum software. From 1.8.13 until 1.8.40, the installer module does not properly escape user-supplied database configuration values written to the configuration file, resulting in PHP code injection and remote code execution when the installer is available...

CVE-2026-73380: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Popup by Supsystic = 1.13.0 versions...

CVE-2026-73341: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in RegistrationMagic = 6.0.9.7 versions...

CVE-2026-75827: Improper Control of Generation of Code

Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the errorlog function through a data directive ...

PT-2026-77103

Unauthenticated Remote File Inclusion in Easy Google Maps 1.14.2 versions...

CVE-2026-52608

An incorrect access control vulnerability in reportico-web = 8.1.0 allows an unauthenticated attacker to inject arbitrary php code into the PreExecuteCode attribute of any report regardless of the safemode setting leading to remote code execution...

EUVD-2026-61091

An incorrect access control vulnerability in reportico-web = 8.1.0 allows an unauthenticated attacker to inject arbitrary php code into the PreExecuteCode attribute of any report regardless of the safemode setting leading to remote code execution...

CVE-2026-52608

An incorrect access control vulnerability in reportico-web = 8.1.0 allows an unauthenticated attacker to inject arbitrary php code into the PreExecuteCode attribute of any report regardless of the safemode setting leading to remote code execution...

CVE-2026-52608

An incorrect access control vulnerability in reportico-web = 8.1.0 allows an unauthenticated attacker to inject arbitrary php code into the PreExecuteCode attribute of any report regardless of the safemode setting leading to remote code execution...

AlmaLinux 10 : php (ALSA-2026:48170)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:48170 advisory. php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD CVE-2026-14355 Bug Fixes and Enhancements: Rebase PHP to 8.3.32 for...

CVE-2026-52608: Improper Access Control

An incorrect access control vulnerability in reportico-web = 8.1.0 allows an unauthenticated attacker to inject arbitrary php code into the PreExecuteCode attribute of any report regardless of the safemode setting leading to remote code execution...

CVE-2026-52607

The reportico-web software (version

PT-2026-77179

MyBB is free and open source forum software. Prior to 1.8.40, the Email User controller does not sanitize sender names correctly, resulting in mail header injection. member.php?action=do emailuser accepts the fromname HTTP parameter for guests or the stored username for authenticated users when t...

AlmaLinux 10 : php8.4 (ALSA-2026:49914)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:49914 advisory. php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD CVE-2026-14355 Bug Fixes and Enhancements: Rebase PHP to 8.4.23 for...

PT-2026-77132

Name of the Vulnerable Software and Affected Versions TaxoPress versions prior to 3.51.1 Description TaxoPress is subject to an object injection issue caused by the deserialization of untrusted data. This occurs when the application processes specially crafted serialized data, allowing an attacke...

PT-2026-77113

Name of the Vulnerable Software and Affected Versions Super Store Finder versions prior to 7.9 Description An unauthenticated SQL Injection exists in the software. SQL Injection is a type of vulnerability that allows an attacker to interfere with the queries that an application makes to its...