php-composer2-2.10.2-2.1 on GA media (moderate)

php-composer2-2.10.2-2.1 on GA media Announcement ID: openSUSE-SU-2026:11300-1 Rating: moderate Cross-References: CVE-2026-45793 CVSS scores: CVE-2026-45793 SUSE : 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can n...

Exploit for CVE-2026-46420

CVE-2026-46420 PoC Command injection in shivammathur/setup-p...

CVE-2026-16155

A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /schoolyr.php. The manipulation of the argument sy leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is...

CVE-2026-16155

SourceCodester Class and Exam Timetabling System 1.0 contains an XSS vulnerability in /schoolyr.php via the sy parameter, allowing remote exploitation. The exploit is publicly available per CVE records; no remediation details are provided in the supplied documents.

EUVD-2026-45399

A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0/1.php. Affected by this vulnerability is an unknown functionality of the file /editroom1.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The...

Cross-site Scripting (XSS)

MantisBT is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper output encoding of user-supplied parameters in /admin/install.php, which allows an attacker to inject malicious HTML that can be used for credential phishing or open redirect attacks...

SUSE-SU-2026:22754-1 Security update for vim

This update for vim fixes the following issues: Update to version 9.2.0780. Security issues fixed: - CVE-2026-59856: arbitrary code execution via PHP omni-completion due to improper escaping bsc1271194. - CVE-2026-59857: out-of-bounds write in SAL soundfolding due to improper bounds check...

SUSE-SU-2026:22821-1 Security update for vim

This update for vim fixes the following issues: Update to version 9.2.0780. Security issues fixed: - CVE-2026-59856: arbitrary code execution via PHP omni-completion due to improper escaping bsc1271194. - CVE-2026-59857: out-of-bounds write in SAL soundfolding due to improper bounds check...

SUSE-SU-2026:22740-1 Security update for vim

This update for vim fixes the following issues: Update to version 9.2.0780. Security issues fixed: - CVE-2026-59856: arbitrary code execution via PHP omni-completion due to improper escaping bsc1271194. - CVE-2026-59857: out-of-bounds write in SAL soundfolding due to improper bounds check...

PT-2026-60990

A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /schoolyr.php. The manipulation of the argument sy leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is...

CVE-2026-54159

CVE-2026-54159 affects PrestaShop ps_facetedsearch module versions 3.0.0 through 4.0.3. The root cause is trusting the value of slider filters (price/weight) from the request URL, storing it in an internal cache, and deserializing it with PHP’s native unserialize(), enabling a crafted object inje...

CVE-2026-54159 ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE

PrestaShop psfacetedsearch is a module that adds layered navigation filters. From 3.0.0 until 4.0.4, the psfacetedsearch module rebuilds selected search filters from the request URL, and the value of a slider filter, price or weight, is taken from the URL without sufficient validation and stored ...

CVE-2026-54159 ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE

PrestaShop psfacetedsearch is a module that adds layered navigation filters. From 3.0.0 until 4.0.4, the psfacetedsearch module rebuilds selected search filters from the request URL, and the value of a slider filter, price or weight, is taken from the URL without sufficient validation and stored ...

CVE-2026-54159 ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE

PrestaShop psfacetedsearch is a module that adds layered navigation filters. From 3.0.0 until 4.0.4, the psfacetedsearch module rebuilds selected search filters from the request URL, and the value of a slider filter, price or weight, is taken from the URL without sufficient validation and stored ...

CVE-2026-54159

PrestaShop psfacetedsearch is a module that adds layered navigation filters. From 3.0.0 until 4.0.4, the psfacetedsearch module rebuilds selected search filters from the request URL, and the value of a slider filter, price or weight, is taken from the URL without sufficient validation and stored ...

CVE-2026-48062

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.3, the extin upload validation rule in system/Validation/StrictRules/FileRules.php checked the MIME-derived guessed extension instead of the client-provided filename extension. As a result, an uploaded file named shell.php containing...

CVE-2026-46420

setup-php is a GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers, and tools. From 2.25.0 prior to 2.37.1, shivammathur/setup-php resolves the PHP version from repository-controlled files such as .php-version, composer.lock through platform-overrides.php, and...

EUVD-2026-45303

setup-php is a GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers, and tools. From 2.25.0 prior to 2.37.1, shivammathur/setup-php resolves the PHP version from repository-controlled files such as .php-version, composer.lock through platform-overrides.php, and...

CVE-2026-46420

shivammathur/setup-php versions 2.25.0–2.37.0 read PHP version strings from repository-controlled files (.php-version, composer.lock, composer.json) and inject them unescaped into generated shell/PowerShell scripts, enabling command injection on GitHub Actions runners via pull_request_target work...

CVE-2026-46420 setup-php: Command Injection in Repository-Derived PHP Version Resolution

setup-php is a GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers, and tools. From 2.25.0 prior to 2.37.1, shivammathur/setup-php resolves the PHP version from repository-controlled files such as .php-version, composer.lock through platform-overrides.php, and...