111628 matches found
php:7.4 security, bug fix, and enhancement update
An update is available for module.php-pecl-xdebug, module.libzip, php, module.php-pecl-rrd, php-pecl-apcu, module.php-pecl-apcu, libzip, php-pecl-zip, php-pecl-rrd, module.php, php-pecl-xdebug, php-pear, module.php-pear, module.php-pecl-zip. This update affects Rocky Linux 8. A Common Vulnerabili...
php:8.2 security, bug fix, and enhancement update
An update is available for module.libzip, php, module.php-pecl-rrd, php-pecl-apcu, module.php-pecl-apcu, libzip, php-pecl-zip, module.php-pecl-zip, php-pecl-rrd, module.php, php-pear, module.php-pear, php-pecl-xdebug3, module.php-pecl-xdebug3. This update affects Rocky Linux 8. A Common...
...[ More ]
A proof of concept exploit for an unauthenticated remote code execution vulnerability in the Fabrik Joomla component versions prior to 4.6.8. A request-controlled filter eval flag can cause an attacker-supplied filter value to be passed to PHP eval, allowing arbitrary PHP and ultimately shell...
CVE-2026-72819: Improper Control of Generation of Code
Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead ...
CVE-2026-73679: Improper Control of Generation of Code
ImpressCMS contains an authenticated remote code execution vulnerability in the custom tag module that allows authenticated administrators to execute arbitrary PHP code by storing a malicious payload in a custom tag with PHP type enabled. The application decodes HTML-encoded content via...
RockyLinux 10 : php (RLSA-2026:48170)
The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:48170 advisory. php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD CVE-2026-14355 Bug Fixes and Enhancements: Rebase PHP to 8.3.32 for...
RockyLinux 9 : php:8.2 (RLSA-2026:40416)
The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:40416 advisory. php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD CVE-2026-14355 Bug Fixes and Enhancements: Rebase PHP to 8.2.32 for...
PT-2026-72089
Name of the Vulnerable Software and Affected Versions ImpressCMS affected versions not specified Description An authenticated remote code execution issue exists in the custom tag module. Authenticated administrators can execute arbitrary PHP code by storing a malicious payload in a custom tag wit...
MiracleLinux 8 : php:8.2 (AXSA:2026-1538:01)
The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1538:01 advisory. php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD CVE-2026-14355 Tenable has extracted the preceding description...
RockyLinux 8 : php:8.2 (RLSA-2026:47749)
The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:47749 advisory. php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD CVE-2026-14355 Bug Fixes and Enhancements: Rebase PHP to 8.2.32 for...
RockyLinux 8 : php:7.4 (RLSA-2026:47750)
The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:47750 advisory. php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD CVE-2026-14355 Bug Fixes and Enhancements: Backport fix for...
RockyLinux 9 : php:8.3 (RLSA-2026:48197)
The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:48197 advisory. php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD CVE-2026-14355 Bug Fixes and Enhancements: Rebase PHP to 8.3.32 for...
MiracleLinux 8 : php:7.4 (AXSA:2026-1535:01)
The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1535:01 advisory. php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD CVE-2026-14355 Tenable has extracted the preceding description...
PT-2026-71988
Name of the Vulnerable Software and Affected Versions Grav CMS versions prior to 2.0.13 Description Authenticated users can achieve remote code execution through a flaw in the Flex Objects plugin settings validation. By utilizing array notation instead of string notation, an attacker can bypass...
...[ More ]
A proof of concept exploit for an unauthenticated PHP object injection vulnerability in WooCommerce Subscriptions versions prior to 9.1.0 when High-Performance Order Storage is enabled. Attacker-controlled data supplied through the User-Agent header can undergo unsafe deserialization during...
CVE-2026-73664
FreePBX is an open source IP PBX. From 17.0.5.34 until 17.0.11, the publicKeySave AJAX endpoint in Backup.class.php accepts an authenticated administrator's SSH public key and appends it to /home/asterisk/.ssh/authorizedkeys for the asterisk system user without reliably enforcing backup-only...
CVE-2026-73533
Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file app/Library/updater/NinjaTableDataSync.php that established a backdoor REST API endpoint,...
CVE-2026-73532
Fluent Forms Pro 6.2.7 is affected by an embedded malicious-code vulnerability introduced via a tampered plugin build served from a decommissioned update server. A rogue PHP file, libs/class-license-sync.php, was loaded through a require_once in fluentformpro.php, creating a backdoor REST API end...
CVE-2026-73532 Fluent Forms Pro 6.2.7 Embedded Malicious Code via Tampered Plugin Build
Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file libs/class-license-sync.php, loaded via a requireonce directive added to fluentformpro.php,...
CVE-2026-73533 Ninja Tables Pro 5.2.11 Embedded Malicious Code via Tampered Plugin Build
Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file app/Library/updater/NinjaTableDataSync.php that established a backdoor REST API endpoint,...