Oracle Linux 8 : php:8.2 (ELSA-2026-47749)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-47749 advisory. libzip php 8.2.32-1 - rebase to 8.2.32 php-pear php-pecl-apcu php-pecl-rrd php-pecl-xdebug3 php-pecl-zip Tenable has extracted the preceding description block...

Oracle Linux 8 : php:7.4 (ELSA-2026-47750)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-47750 advisory. libzip php 7.4.33-5 - Fix Memory corruption zendmmheap corrupted in opensslencrypt with AES-WRAP-PAD CVE-2026-14355 php-pear php-pecl-apcu php-pecl-rrd...

Oracle Linux 10 : php (ELSA-2026-48170)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-48170 advisory. 8.3.32-1 - rebase to 8.3.32 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has not...

CVE-2026-16062

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not prevent the deserialization of user-controlled input in some of its event content fields, allowing users with Contributor-level access and above to inject PHP objects. No POP chain is present in the Event Booking...

CVE-2026-16062 Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ PHP Object Injection via Event Timeline and FAQ Content

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not prevent the deserialization of user-controlled input in some of its event content fields, allowing users with Contributor-level access and above to inject PHP objects. No POP chain is present in the Event Booking...

php:8.2 security, bug fix, and enhancement update

libzip php 8.2.32-1 - rebase to 8.2.32 php-pear php-pecl-apcu php-pecl-rrd php-pecl-xdebug3 php-pecl-zip...

php8-8.5.9-1.1 on GA media (moderate)

php8-8.5.9-1.1 on GA media Announcement ID: openSUSE-SU-2026:11418-1 Rating: moderate Cross-References: CVE-2026-17543 CVE-2026-17544 CVE-2026-7260 CVE-2026-9672 CVSS scores: CVE-2026-17543 SUSE : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2026-17543 SUSE : 9.3...

CVE-2026-17605

The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.56 via the getpaidpaymentformelement function. This makes it possible for authenticated attackers, with administrator-level acces...

EUVD-2026-51757

The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.56 via the getpaidpaymentformelement function. This makes it possible for authenticated attackers, with administrator-level acces...

CVE-2026-17605

The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.56 via the getpaidpaymentformelement function. This makes it possible for authenticated attackers, with administrator-level acces...

CVE-2026-13157

The Demo Import WordPress plugin through 1.1.3 does not validate the type of files uploaded during demo-content import the WordPress file-type test is disabled, allowing high-privilege users Administrator by default, including non-super-admin site administrators on multisite to upload executable...

EUVD-2026-51713

The Demo Import WordPress plugin through 1.1.3 does not validate the type of files uploaded during demo-content import the WordPress file-type test is disabled, allowing high-privilege users Administrator by default, including non-super-admin site administrators on multisite to upload executable...

CVE-2026-13157

The Demo Import WordPress plugin through 1.1.3 does not validate the type of files uploaded during demo-content import the WordPress file-type test is disabled, allowing high-privilege users Administrator by default, including non-super-admin site administrators on multisite to upload executable...

CVE-2026-13157

CVE-2026-13157 affects the WordPress plugin “Theme Demo Import” ( false during demo-content imports, allowing any authenticated user with import capabilities (e.g., site Administrator, including non-super-admins on multisite) to upload executable PHP files to the public uploads directory. This en...

CVE-2026-13158

The Everest Toolkit WordPress plugin through 1.2.3 does not validate the type of files uploaded during demo-content import the WordPress file-type test is disabled, allowing high-privilege users Administrator by default, including non-super-admin site administrators on multisite to upload...

CVE-2026-13158

The Everest Toolkit WordPress plugin (versions 1.2.3) and implement proper upload handling (e.g., using WordPress wp_handle_upload with strict whitelisting) plus server rules to prevent PHP execution in uploads. If exploiting evidence exists, PoCs or in-wild links are mentioned within connected ...

CVE-2026-7260 affecting package php for versions less than 8.3.33-1

CVE-2026-7260 affecting package php for versions less than 8.3.33-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-17543 affecting package php for versions less than 8.3.33-1

CVE-2026-17543 affecting package php for versions less than 8.3.33-1. An upgraded version of the package is available that resolves this issue...

[SECURITY] Fedora 44 Update: php-8.5.9-1.fc44

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

RLSA-2026:48650 Important: vim security update

Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: Vim: Denial of Service via stack out-of-bounds write in spellsoundfoldsofo CVE-2026-57455 vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion CVE-2026-57456 vim: Vim:...