[SECURITY] Fedora 43 Update: composer-2.10.2-1.fc43

Composer helps you declare, manage and install dependencies of PHP projects, ensuring you have the right stack everywhere. Documentation: https://getcomposer.org/doc/...

ImageMagick: ImageMagick: Denial of Service via crafted MSL image leading to heap-use-after-free

A flaw was found in ImageMagick, a free and open-source software used for editing and manipulating digital images. A remote attacker could exploit this vulnerability by providing a specially crafted MSL Magick Scripting Language image. Processing this malicious image could trigger a...

The vulnerability of the urldecode() function in the PHP programming language allows a hacker to trigger a service failure.

The vulnerability of the urldecode function in the PHP programming language is related to reading data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause a service failure remotely...

ROS-20260618-73-0005

The vulnerability of the MSL Magick Scripting Language command in the console-based image editing tool ImageMagick is related to the execution of a loop with an unavailable exit condition. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260618-73-0006

The vulnerability of the MSL Magick Scripting Language command in the console-based image editing tool ImageMagick is related to the execution of a loop with an unavailable exit condition. Exploiting this vulnerability can allow an attacker to cause a service failure...

EUVD-2026-37473

Unauthenticated PHP Object Injection in Elementra = 1.0.9 versions...

CVE-2026-54362

The CVE concerns MISP's event template builder where an incorrect visibility condition allowed authenticated non-site-admin users to see galaxies outside their organisation. The root cause is a PHP comparison expression used instead of a query condition, causing enabled galaxies, including organi...

CVE-2026-46523

A flaw was found in ImageMagick, a free and open-source software used for editing and manipulating digital images. A remote attacker could exploit this vulnerability by providing a specially crafted MSL Magick Scripting Language image. Processing this malicious image could trigger a...

The vulnerability of the administrative interface of the Java Lucee virtual machine allows a perpetrator to execute arbitrary code.

The vulnerability of the administrative interface of the Java Lucee virtual machine’s scripting language is related to incorrect code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

php: signed integer overflow in metaphone()

A flaw was found in PHP. The metaphone function in ext/standard/metaphone.c uses a signed int variable to track the current position within the input string. When an input string is longer than 2,147,483,647 bytes, a signed integer overflow can occur, leading to undefined behavior and an...

The vulnerability of the soap_add_xml_ref() function in the PHP programming language allows a hacker to execute arbitrary code.

The vulnerability of the soapaddxmlref function in the PHP programming language is related to the possibility of using memory after it has been freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

BIT-LIBPHP-2026-7261 SoapServer session-persisted object use-after-free via SOAP header fault

In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, and 8.5. before 8.5.6, when SoapServer is configured with SOAPPERSISTENCESESSION, the handler object is persisted across requests via session storage. However, in the case SOAP requests results in an error, the persistanc...

编号撤回

R is a statistical computing software from The R Foundation. fe is a lightweight, embeddable ANSI C scripting language developed by rxi. This CVE number has been withdrawn...

Unity Linux 20.1060e / 20.1070e Security Update: php (UTSA-2026-017496)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017496 advisory. In PHP versions 7.3.x below 7.3.26, 7.4.x below 7.4.14 and 8.0.0, when validating URL with functions like filtervar$url, FILTERVALIDATEURL, PHP will accept an URL wi...

CVE-2026-7263

In PHP versions 8.4. before 8.4.21 and 8.5. before 8.5.6, DOMNode::C14N method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial ...

EUVD-2024-31033

Prison Management System Using PHP v1.0 was discovered to contain a SQL injection vulnerability via the username on the Admin login page...

PHP 8.5.x < 8.5.6 Multiple Vulnerabilities

The version of PHP installed on the remote host is prior to 8.5.6. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.5.6 advisory. - uriparser before 1.0.1 has numeric truncation in text range comparison, if an application accepts URIs with a length in gigabyte...

PT-2026-33987

Name of the Vulnerable Software and Affected Versions Dolibarr ERP & CRM versions prior to 22.0.5 Description In the Website module, the application employs blacklist-based filtering to restrict dangerous PHP functions associated with system command execution. An authenticated user with permissio...

CVE-2026-40301

DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to version 1.0.10, DOMSanitizer::sanitize allows...

CVE-2026-40312

A flaw was found in ImageMagick. A remote attacker could exploit an off-by-one error when processing a specially crafted malicious MSL Magick Scripting Language file. This vulnerability could lead to a denial of service DoS by causing the application to crash, making it unavailable to users...