EUVD-2026-57932

Editor PHP Object Injection in Car Rental Manager = 1.3.9 versions...

CVE-2026-27380 WordPress Car Rental Manager plugin <= 1.3.9 - PHP Object Injection vulnerability

Editor PHP Object Injection in Car Rental Manager = 1.3.9 versions...

CVE-2026-27380 WordPress Car Rental Manager plugin <= 1.3.9 - PHP Object Injection vulnerability

Editor PHP Object Injection in Car Rental Manager = 1.3.9 versions...

CVE-2026-49827

WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scanfile parameter, leading to Remote Code Execution. Combined with open registration no invite...

CLSA-2026-1786625623 TuxCare security update for craftcms/cms (1 CVE)

TuxCare rebuilt craftcms/cms to address 1 CVE. Fixed in 3.9.15-p8+tuxcare...

EUVD-2026-57830

WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scanfile parameter, leading to Remote Code Execution. Combined with open registration no invite...

CVE-2026-49827 WebErpMesv2 has Unauthenticated RCE via Unrestricted File Upload in HR Expense scan_file (CWE-434)

WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scanfile parameter, leading to Remote Code Execution. Combined with open registration no invite...

CVE-2026-49827

WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scanfile parameter, leading to Remote Code Execution. Combined with open registration no invite...

CLSA-2026-1786448352 php: Fix of 3 CVEs

CVE-2026-7260: fix stack exhaustion on circular symlinks in tar-based phar archives; also backport upstream bug 69720 NULL pointer dereference in phargetfpoffset, without which the fix only relocates the crash - CVE-2026-17543: fix SQL injection in ext/pgsql via backslash breakout from E'...'...

CLSA-2026-1785755669 php: Fix of 3 CVEs

CVE-2026-17543: fix SQL injection in ext/pgsql via E'...' backslash breakout in phppgsqladdquotes GHSA-7qpv-r5mr-78m4 - CVE-2026-7260: fix stack exhaustion from circular symlinks in phar archives by replacing recursion in phargetlinksource with cycle detection GHSA-vc5h-9ppw-p5f3...

WordPress Booking Activities plugin <= 1.18.4 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Taylsec in WordPress Plugin Booking Activities versions = 1.18.4...

CLSA-2026-1786616236 TuxCare security update for webonyx/graphql-php (4 CVEs)

TuxCare rebuilt webonyx/graphql-php to address 4 CVEs. Fixed in v14.11.10-p1+tuxcare...

CLSA-2026-1786609589 TuxCare security update for phenx/php-svg-lib (3 CVEs)

TuxCare rebuilt phenx/php-svg-lib to address 3 CVEs. Fixed in 0.4.1-p1+tuxcare...

CVE-2026-14182 Customer Email Verification for WooCommerce < 3.2.6 - Unauthenticated Account Takeover via Type-Juggling Authentication Bypass

The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the accoun...

CVE-2026-14355

A flaw was found in the OpenSSL extension of PHP. The AES-WRAP-PAD algorithm implementation uses the size of the plaintext length without accounting for the RFC 5649 expansion to allocate the output buffer for the AES key-wrap-with-padding operation. This may lead to an undersized memory allocati...

Exploit for CVE-2026-14282

CVE-2026-14282 — GoDAM WordPress Plugin RCE Author: null...

CVE-2026-46382

The Meeting Room Booking System MRBS is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, a user-supplied private/local URI can be made to be fetched without checks. Version 1.12.2 contains a fix. No known workarounds are available...

PT-2026-71525

Name of the Vulnerable Software and Affected Versions Booking Activities versions prior to 1.18.5 Description The Booking Activities plugin for WordPress allows unauthenticated attackers to perform PHP Object Injection through the deserialization of untrusted input. PHP Object Injection occurs wh...

PT-2026-80149

TuxCare rebuilt webonyx/graphql-php to address 4 CVEs. Fixed in v14.11.10-p1+tuxcare...

CVE-2026-46688: URL Redirection to Untrusted Site

The Meeting Room Booking System MRBS is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, an unauthenticated request can be made to redirect the user to a query-specified location. This allows an attacker to create a specially-crafted URL to an MRBS installation that wil...