php

Persistent Denial of Service in Kirby CMS via malformed image upload. An authenticated Editor can crash the application into an unrecoverable state by exploiting unchecked getimagesize() return values.

Unauthenticated LFI in Bagisto allows arbitrary file read via path traversal without authentication. Disclosed via CERT-In and assigned CVE-2026-9506.