CVE-2026-107362

The Malcolm file-upload component is vulnerable to a Server-Side Request Forgery (SSRF) due to its inclusion of the upstream FilePond PHP server (pqina/filepond-server-php) with largely unmodified files. Specifically, the upstream index.php contains a fetch API route that uses curl (with FOLLOWLO...

WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.5.8 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WooCommerce Multilingual & Multicurrency versions = 5.5.8...

WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.10 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by V1T in WordPress Plugin AFFI – Affiliate Marketing for WooCommerce versions = 1.0.10...

WordPress Asia Garden theme <= 1.3.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Asia Garden versions = 1.3.1...

WordPress Super Video Player plugin <= 1.8.13 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Plugin Super Video Player versions = 1.8.14...

hashes

Hash magici – "collisioni" di hash PHP Registrati con password 1 e poi accedi con password 2. Se riesci ad accedere, l'archiviazione usa l'algoritmo specificato per calcolare l'hash della password e PHP usa == per confrontarle per MD5, SHA-1 e plaintext. MD5, SHA-1, SHA-224, SHA-256 e altri Per M...

dompdf-rce

Exploit RCE per dompdf Questo repository contiene un'applicazione demo vulnerabile che utilizza dompdf 1.2.0 e un exploit che consente l'esecuzione remota di codice tramite un file poliglotta ttf+php. Per maggiori dettagli, visita https://positive.security/blog/dompdf-rce Istruzioni 1. Esegui...

phpggc

PHPGGC: Catene di Gadget Generici PHP PHPGGC è una libreria di payload unserialize insieme a uno strumento per generarli, da riga di comando o programmaticamente. Quando incontri una unserialize su un sito web di cui non hai il codice, o semplicemente quando cerchi di costruire un exploit, questo...

php_filter_chains_oracle_exploit

PHP filter chains: lettura di file da oracolo basato su errori Una CLI per sfruttare parametri affetti dalla lettura di file causata dall'oracolo basato su errori delle catene di filtri PHP. Può essere usata per esfiltrare il contenuto di un file locale quando viene passato a funzioni vulnerabili...

CVE-2026-105830

league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of service vulnerability in the GitHub Flavored Markdown Table extension's TableStartParser::tryStart block-start scan. Unauthenticated attackers can submit a large paragraph of pipe-free lines not starting with letters,...

EUVD-2026-95017

league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of service vulnerability in the GitHub Flavored Markdown Table extension's TableStartParser::tryStart block-start scan. Unauthenticated attackers can submit a large paragraph of pipe-free lines not starting with letters,...

CVE-2026-105830

The league/commonmark library (versions 2.0.0 before 2.10.2 ) is vulnerable to a quadratic-time denial of service (DoS) attack within the GitHub Flavored Markdown Table extension. The issue resides in the TableStartParser::tryStart() block-start scan, where unauthenticated attackers can submit a ...

CVE-2026-105830 league/commonmark 2.0.0 before 2.10.2 Quadratic DoS via TableStartParser

league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of service vulnerability in the GitHub Flavored Markdown Table extension's TableStartParser::tryStart block-start scan. Unauthenticated attackers can submit a large paragraph of pipe-free lines not starting with letters,...

CVE-2026-105830 league/commonmark 2.0.0 before 2.10.2 Quadratic DoS via TableStartParser

league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of service vulnerability in the GitHub Flavored Markdown Table extension's TableStartParser::tryStart block-start scan. Unauthenticated attackers can submit a large paragraph of pipe-free lines not starting with letters,...

CVE-2026-105830

league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of service vulnerability in the GitHub Flavored Markdown Table extension's TableStartParser::tryStart block-start scan. Unauthenticated attackers can submit a large paragraph of pipe-free lines not starting with letters,...

WordPress Booster for WooCommerce plugin <= 8.4.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by John Ryan Albon in WordPress Plugin Booster for WooCommerce versions = 8.4.0...

WordPress Tainacan plugin <= 1.3.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Tainacan versions = 1.3.0...

WordPress Slider by 10Web plugin <= 1.2.62 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Slider by 10Web versions = 1.2.62...

Security update for php-composer2

This update for php-composer2 fixes the following issues: CVE-2026-59946: package bin entries with path segments can cause unintended host file permission modifications bsc1271152. CVE-2026-59947: unsanitized URL credential handling in debug output within Composer can allow sensitive token...

SUSE-SU-2026:4589-1 Security update for php-composer2

This update for php-composer2 fixes the following issues: - CVE-2026-59946: package bin entries with path segments can cause unintended host file permission modifications bsc1271152. - CVE-2026-59947: unsanitized URL credential handling in debug output within Composer can allow sensitive token...