Most recent entries from all

certfr-2026-avi-1227 — De multiples vulnérabilités ont été découvertes dans PHP. Certaines d'entre elles permettent à un attaquant de provoque…

2026-09-28T09:48:10.277620+00:00

certfr-2026-avi-1227

fkie_cve-2026-91765

2026-09-28T09:48:10.277696+00:00

cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.

RHSA-2026:70720 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

2026-09-28T09:48:10.277753+00:00

php: php: Denial of Service via out-of-bounds read in mysqlnd wire protocol parser php: PHP: Archive entry injection via integer overflow in TAR parser php: PHP: Denial of Service via reserved device names on Windows php: php: Denial of Service via unbounded recursion in SOAP parser php: php: Credential disclosure via cross-origin HTTP redirects php: php: Information disclosure via crafted TLS server certificate php: php: Access control bypass via partial IPv6 address comparison php: php: Information disclosure via out-of-bounds read in stream filters php: php: Out-of-bounds read via empty HTTP redirect Location header

UBUNTU-CVE-2026-91765

2026-09-28T09:48:10.277815+00:00

Affected: Ubuntu:Pro:14.04:LTS: php5, Ubuntu:Pro:16.04:LTS: php7.0, Ubuntu:Pro:18.04:LTS: php7.2, Ubuntu:Pro:20.04:LTS: php7.4, Ubuntu:22.04:LTS: php8.1, Ubuntu:24.04:LTS: php8.3, Ubuntu:26.04:LTS: php8.5

[Unknown description]