CVE-2026-7261

In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, and 8.5. before 8.5.6, when SoapServer is configured with SOAPPERSISTENCESESSION, the handler object is persisted across requests via session storage. However, in the case SOAP requests results in an error, the persistanc...

CVE-2026-7261

CVE-2026-7261 affects PHP SOAP when SOAP_PERSISTENCE_SESSION is used. In PHP 8.2.x before 8.2.31, 8.3.x before 8.3.31, 8.4.x before 8.4.21, and 8.5.x before 8.5.6, the SOAP handler object is persisted across requests via session storage. If a SOAP fault occurs, the persistence handling frees the ...

CVE-2026-7261 SoapServer session-persisted object use-after-free via SOAP header fault

In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, and 8.5. before 8.5.6, when SoapServer is configured with SOAPPERSISTENCESESSION, the handler object is persisted across requests via session storage. However, in the case SOAP requests results in an error, the persistanc...

CVE-2026-7261

In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, and 8.5. before 8.5.6, when SoapServer is configured with SOAPPERSISTENCESESSION, the handler object is persisted across requests via session storage. However, in the case SOAP requests results in an error, the persistanc...

EUVD-2026-28970

In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, and 8.5. before 8.5.6, when SoapServer is configured with SOAPPERSISTENCESESSION, the handler object is persisted across requests via session storage. However, in the case SOAP requests results in an error, the persistanc...

CVE-2026-7261 SoapServer session-persisted object use-after-free via SOAP header fault

In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, and 8.5. before 8.5.6, when SoapServer is configured with SOAPPERSISTENCESESSION, the handler object is persisted across requests via session storage. However, in the case SOAP requests results in an error, the persistanc...

PHP 缓冲区错误漏洞

PHP is an open-source scripting language executed on the server side. Versions of PHP prior to 8.2.31, 8.3.31, 8.4.21, and 8.5.6 contained a buffer error vulnerability. This vulnerability stemmed from the use of the metaphone function, which used signed integer variables to track the current...

Dotouch XproUPF 安全漏洞

Dotouch XproUPF is an intelligent conference tablet device from the Dotouch company, featuring integrated touch display and multimedia interaction capabilities. The Dotouch XproUPF 2.0.0-release-088aa7c4 version contains a security vulnerability. This vulnerability stems from a denial-of-service...

OESA-2026-2224 perl-Image-ExifTool security update

ExifTool is a Perl module with an included command-line application for reading and writing meta information in image, audio, and video files. It reads EXIF, GPS, IPTC, XMP, JFIF, MakerNotes, GeoTIFF, ICC Profile, Photoshop IRB, FlashPix, AFCP, and ID3 meta information from JPG, JP2, TIFF, GIF,...

OESA-2026-2222 perl-Image-ExifTool security update

ExifTool is a Perl module with an included command-line application for reading and writing meta information in image, audio, and video files. It reads EXIF, GPS, IPTC, XMP, JFIF, MakerNotes, GeoTIFF, ICC Profile, Photoshop IRB, FlashPix, AFCP, and ID3 meta information from JPG, JP2, TIFF, GIF,...

CVE-2026-42301 Improper Input Validation leading to Improper Control of Generation of Code ('Code Injection') in pyp2spec

pyp2spec generates working Fedora RPM spec file for Python projects. Prior to version 0.14.1, pyp2spec was writing PyPI package metadata e.g. the summary field into the generated spec file without escaping RPM macro directives. When a packager then runs rpmbuild, those directives get evaluated, s...

SUSE CVE-2026-41570

PHPUnit is a testing framework for PHP. In versions 12.5.21 and 13.1.5, PHPUnit forwards PHP INI settings to child processes used for isolated/PHPT test execution as -d name=value command-line arguments without neutralizing INI metacharacters. Because PHP's INI parser interprets " as a string...

CVE-2024-33724

SOPlanning 1.52.00 is vulnerable to Cross Site Scripting XSS via the groupeid parameter to process/groupesave.php...

GHSA-3V2C-X6Q9-F697 vulnerabilities

Vulnerabilities for packages: argo-events-fips, otel-cli, virt-controller-fips, gatekeeper, contour-fips, openbao-fips, cloudbeat, oauth2-proxy-fips, rancher, azure-aad-pod-identity-mic, crossplane-aws-provider-fips, crossplane-provider-aws-opensearchserverless, gitlab-rails-ce-fips,...

CVE-2026-39823 vulnerabilities

Vulnerabilities for packages: argo-events-fips, otel-cli, virt-controller-fips, gatekeeper, contour-fips, openbao-fips, cloudbeat, oauth2-proxy-fips, rancher, azure-aad-pod-identity-mic, crossplane-aws-provider-fips, crossplane-provider-aws-opensearchserverless, gitlab-rails-ce-fips,...

GHSA-2283-WF8C-RW8R vulnerabilities

Vulnerabilities for packages: argo-events-fips, otel-cli, virt-controller-fips, gatekeeper, contour-fips, openbao-fips, cloudbeat, oauth2-proxy-fips, rancher, azure-aad-pod-identity-mic, crossplane-aws-provider-fips, crossplane-provider-aws-opensearchserverless, gitlab-rails-ce-fips,...

CVE-2026-39826 vulnerabilities

Vulnerabilities for packages: argo-events-fips, otel-cli, virt-controller-fips, gatekeeper, contour-fips, openbao-fips, cloudbeat, oauth2-proxy-fips, rancher, azure-aad-pod-identity-mic, crossplane-aws-provider-fips, crossplane-provider-aws-opensearchserverless, gitlab-rails-ce-fips,...

CVE-2026-39817 vulnerabilities

Vulnerabilities for packages: argo-events-fips, kube-logging-operator-fips, otel-cli, gatekeeper, virt-controller-fips, contour-fips, openbao-fips, cloudbeat, oauth2-proxy-fips, rancher, azure-aad-pod-identity-mic, crossplane-aws-provider-fips, crossplane-provider-aws-opensearchserverless,...

CVE-2026-39819 vulnerabilities

Vulnerabilities for packages: argo-events-fips, kube-logging-operator-fips, otel-cli, gatekeeper, virt-controller-fips, contour-fips, openbao-fips, cloudbeat, oauth2-proxy-fips, rancher, azure-aad-pod-identity-mic, crossplane-aws-provider-fips, crossplane-provider-aws-opensearchserverless,...

CVE-2026-42501 vulnerabilities

Vulnerabilities for packages: argo-events-fips, kube-logging-operator-fips, otel-cli, gatekeeper, virt-controller-fips, contour-fips, openbao-fips, cloudbeat, oauth2-proxy-fips, rancher, azure-aad-pod-identity-mic, crossplane-aws-provider-fips, crossplane-provider-aws-opensearchserverless,...