110395 matches found
CVE-2026-71626
A vulnerability in Invoice Ninja v5.13.24 allows a remote attacker to obtain sensitive information . The issue is located within the StoreWebhookRequest.php , UpdateWebhookRequest.php , and WebhookSingle.php components. While the technical root cause is not explicitly detailed in the provided doc...
CVE-2026-82923: Missing Authorization
The AI Website Builder WordPress plugin GitHub build 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated attackers to install and activate plugins and themes, import content from a URL under their control, write a file of their choosing into th...
AppAuthentication::verifyCode() MultiFactor Auth Bypass
The vulnerability of the AppAuthentication::verifyCode method in the packages/panels/src/Auth/MultiFactor/App/AppAuthentication.php file of the Filament PHP framework’s Laravel set is related to the possibility of bypassing the authentication process. Exploiting this vulnerability could allow an...
CVE-2026-61686: Deserialization of Untrusted Data
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the DataGrid LiveComponent deserializes a context prop value using PHP's unserialize after receiving it from the client. Because the prop is marked writable: true, an authenticated attacker can supply an arbitrary PHP...
Oracle Linux 8 : ELSA-2026-62334-0: / php:7.4 (ELSA-2026-623340)
The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-623340 advisory. - Fixed SQL injection via E'...' backslash breakout CVE-2026-17543 - Fixed GHSA-vc5h-9ppw-p5f3 Crash via recursive symlinks CVE-2026-7260 php-pear...
php security, bug fix, and enhancement update
8.0.30-8 - Fix leak on double DatePeriod::construct call - Fixed SQL injection via E'...' backslash breakout CVE-2026-17543 - Fixed GHSA-vc5h-9ppw-p5f3 Crash via recursive symlinks CVE-2026-7260 8.0.30-7 - Fix Memory corruption zendmmheap corrupted in opensslencrypt with AES-WRAP-PAD CVE-2026-143...
OPENSUSE-SU-2026:11689-1 php-composer2-2.10.3-2.1 on GA media
These are all security issues fixed in the php-composer2-2.10.3-2.1 package on the GA media of openSUSE Tumbleweed...
Oracle Linux 9 : ELSA-2026-61259-0: / php (ELSA-2026-612590)
The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-612590 advisory. - Fixed SQL injection via E'...' backslash breakout CVE-2026-17543 - Fixed GHSA-vc5h-9ppw-p5f3 Crash via recursive symlinks CVE-2026-7260 Tenable has...
Linux Distros Unpatched Vulnerability : CVE-2026-76060
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitiz...
MiracleLinux 8 : php:7.4 (AXSA:2026-1772:01)
The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1772:01 advisory. php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar...
MINI-PHRP-C2QX-VF5P
Bulletin has no description...
CVE-2026-13001
CVE-2026-13001 — Podlove Podcast Publisher Unauthenticated File Upload RCE isimage vs extractfileextension Mismatch → PHP Polyglot Upload Overview CVE-2026-13001 is a critical-severity CVSS 9.8 unauthenticated arbitrary file upload vulnerability in the Podlove Podcast Publisher WordPress plugin...
EUVD-2026-70732
A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. The affected element is the function doInsert of the file /rider/orders/controller.php?action=add of the component Order Management Controller. Performing a manipulation of the argument image results in...
CVE-2026-84968
An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error message that is returned to application code. This may result in unintended...
DEBIAN-CVE-2026-84968
An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error message that is returned to application code. This may result in unintended...
UBUNTU-CVE-2026-84968
An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error message that is returned to application code. This may result in unintended...
CVE-2026-84968
An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error message that is returned to application code. This may result in unintended...
CVE-2026-84834
Unauthenticated PHP Object Injection in JobSearch = 3.2.0 versions...