110498 matches found
CLEANSTART-2026-OZ96009 Security fix for GHSA-ch8v-r6jh-4vvr applied in: php 8.3.35-r0
Security vulnerability affects the php package. This issue is resolved in later releases. See references for vulnerability details...
CLEANSTART-2026-UY82629 mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them
Security vulnerability affects the php package. The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them...
CLEANSTART-2026-ZN45327 phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check
Security vulnerability affects the php package. phartarnumber parses the octal size field of a TAR header into a uint32t with no overflow check...
CLEANSTART-2026-WW44198 SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger
Security vulnerability affects the php package. The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger...
CVE-2026-94062: Improper Control of Filename for Include/Require Statement in PHP Program
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Fuelthemes Werkstatt werkstatt allows PHP Local File Inclusion.This issue affects Werkstatt: from n/a through 4.8.3...
CVE-2026-94067: Improper Control of Filename for Include/Require Statement in PHP Program
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Fuelthemes The Voux thevoux-wp allows PHP Local File Inclusion.This issue affects The Voux: from n/a through 6.9.5...
PT-2026-108917
Name of the Vulnerable Software and Affected Versions Fuelthemes The Voux versions prior to 6.9.5 Description Fuelthemes The Voux contains an improper control of filename for include/require statement in PHP program, which allows for PHP Local File Inclusion. This occurs when the application fail...
CentOS Linux 8.4 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1791483256)
The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1791483256 advisory. - The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for...
PT-2026-109177
Stack-based Buffer Overflow, Integer Overflow or Wraparound vulnerability in Apache Thrift php bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...
PT-2026-109207
Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...
CVE-2025-15700: Unrestricted Upload of File with Dangerous Type
The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an uploaded ZIP archive during its listing-import feature, allowing users with the AWP Classifieds WordPress plugin before 4.4.9's management capability to upload arbitrary PHP files to a publicly...
PT-2026-108903
Name of the Vulnerable Software and Affected Versions Fuelthemes Werkstatt versions prior to 4.8.3 Description Fuelthemes Werkstatt contains an improper control of filename for include/require statement in PHP program, which allows for PHP Local File Inclusion. This occurs when the application...
CVE-2024-25600-WordPress-Bricks-Builder-RCE-PoC
CVE-2024-25600 — WordPress Bricks Builder RCE PoC Unauthenticated remote code execution vulnerability in WordPress Bricks Builder id uid=33www-data gid=33www-data groups=33www-data References CVE-2024-25600 Bricks Builder Security Advisory Wordfence writeup Credits Discovery: Snicco / Calvin Alka...
DEBIAN-CVE-2026-106436
The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an invalid state. An unauthenticated actor who can cause an affected application to encode an unusually large data structure can terminate the...
CVE-2026-106436
The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an invalid state. An unauthenticated actor who can cause an affected application to encode an unusually large data structure can terminate the...
DEBIAN-CVE-2026-106432
The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size can wrap while the copy operation uses the original length. The resulting heap buffer overflow can corrupt proces...
CVE-2026-106432
The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size can wrap while the copy operation uses the original length. The resulting heap buffer overflow can corrupt proces...
CVE-2026-106436
The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an invalid state. An unauthenticated actor who can cause an affected application to encode an unusually large data structure can terminate the...
CVE-2026-106432
The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size can wrap while the copy operation uses the original length. The resulting heap buffer overflow can corrupt proces...
