https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T14:04:51.181133+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bell-cve-2026-91768 BELL-CVE-2026-91768 2026-10-02T14:04:51.254493+00:00

Affected: Alpaquita:25: php83, Alpaquita:stream: php83

 https://cve.radiocsirt.org/vuln/bit-libphp-2026-91768 BIT-libphp-2026-91768 — IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes) 2026-10-02T14:04:51.254545+00:00

Affected: Bitnami: libphp

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint.

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1227 certfr-2026-avi-1227 — De multiples vulnérabilités ont été découvertes dans PHP. Certaines d'entre elles permettent à un attaquant de provoque… 2026-10-02T14:04:51.254573+00:00 certfr-2026-avi-1227 https://cve.radiocsirt.org/vuln/euvd-2026-377577 EUVD-2026-377577 2026-10-02T14:04:51.254591+00:00 EUVD-2026-377577 https://cve.radiocsirt.org/vuln/fkie_cve-2026-91768 fkie_cve-2026-91768 2026-10-02T14:04:51.254602+00:00

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-91768 msrc_CVE-2026-91768 — IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes) 2026-10-02T14:04:51.254624+00:00 msrc_CVE-2026-91768 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11901-1 openSUSE-SU-2026:11901-1 — php8-8.5.11-1.1 on GA media 2026-10-02T14:04:51.254640+00:00

php8-8.5.11-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:70720 RHSA-2026:70720 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update 2026-10-02T14:04:51.254658+00:00

php: php: Denial of Service via out-of-bounds read in mysqlnd wire protocol parser php: PHP: Denial of Service via heap buffer overflow in SOAP client php: PHP: Archive entry injection via integer overflow in TAR parser php: PHP: Denial of Service via reserved device names on Windows php: php: Denial of Service via unbounded recursion in SOAP parser php: php: Credential disclosure via cross-origin HTTP redirects php: php: Information disclosure via crafted TLS server certificate php: php: Access control bypass via partial IPv6 address comparison php: php: Server impersonation via Common Name fallback in TLS verification php: php: Information disclosure via out-of-bounds read in stream filters php: php: Out-of-bounds read via empty HTTP redirect Location header

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-91768 UBUNTU-CVE-2026-91768 2026-10-02T14:04:51.254687+00:00

Affected: Ubuntu:Pro:14.04:LTS: php5, Ubuntu:Pro:16.04:LTS: php7.0, Ubuntu:Pro:18.04:LTS: php7.2, Ubuntu:Pro:20.04:LTS: php7.4, Ubuntu:22.04:LTS: php8.1, Ubuntu:24.04:LTS: php8.3, Ubuntu:26.04:LTS: php8.5

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint.