EUVD-2026-66939

Editor PHP Object Injection in Fluent Boards Pro = 2.0.11 versions...

CVE-2026-78276

CVE-2026-78276 affects the WordPress Fluent Boards Pro plugin, versions 2.0.11 and earlier , where an Editor-level user can perform PHP Object Injection , leading to potential high impact on confidentiality, integrity, and availability (CVSS 3.1 score 7.2 / HIGH ). The vulnerability is network-re...

CVE-2026-78257 WordPress Booking and Rental Manager plugin <= 2.7.5 - PHP Object Injection vulnerability

Contributor PHP Object Injection in Booking and Rental Manager = 2.7.5 versions...

CVE-2026-78257

CVE-2026-78257 is a PHP Object Injection vulnerability in the WordPress plugin Booking and Rental Manager for WooCommerce (versions ≤ 2.7.5), discovered by daroo and rated CVSS 8.8 (High) by Patchstack. The flaw allows a user with Contributor privilege to exploit the injection over the network wi...

CVE-2026-78257 WordPress Booking and Rental Manager plugin <= 2.7.5 - PHP Object Injection vulnerability

Contributor PHP Object Injection in Booking and Rental Manager = 2.7.5 versions...

EUVD-2026-66992

Contributor PHP Object Injection in Booking and Rental Manager = 2.7.5 versions...

WordPress Create Block Theme plugin < 2.10.0 - Admin+ PHP Code Injection via Pattern Save (Multisite) vulnerability

Admin+ PHP Code Injection via Pattern Save Multisite vulnerability discovered by Pavan Saxena Rootkid in WordPress Plugin Create Block Theme versions 2.10.0...

Exploit for CVE-2026-38526

🏴‍☠️ HTB Labs - Nexus English 🇺🇸 | Español 🇪🇸 English...

CVE-2026-77991

Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager 5.0.1 - The administrator source model allows to write dangerous file type incl. PHP, leading to remote code execution...

CVE-2026-77991 Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1

Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager 5.0.1 - The administrator source model allows to write dangerous file type incl. PHP, leading to remote code execution...

CVE-2026-77991

Joomla Event Manager (a Joomla extension from joomlaeventmanager.net) versions prior to 5.0.1 are vulnerable to privileged remote code execution due to a flaw in the administrator source model , which allows writing dangerous file types including PHP. An authenticated attacker with high privilege...

EUVD-2026-66866

Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager 5.0.1 - The administrator source model allows to write dangerous file type incl. PHP, leading to remote code execution...

CVE-2026-77991 Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1

Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager 5.0.1 - The administrator source model allows to write dangerous file type incl. PHP, leading to remote code execution...

CVE-2026-78276: Deserialization of Untrusted Data

Editor PHP Object Injection in Fluent Boards Pro = 2.0.11 versions...

EUVD-2026-67262

Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected endpoint...

TencentOS Server 3: php:8.2 (TSSA-2026:0930)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0930 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

CVE-2026-37069: Exposure of Sensitive Information to an Unauthorized Actor

Absolute Path Disclosure in /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to know in which system directory the application code is running by sending a GET request to the endpoint...

PT-2026-82538

Name of the Vulnerable Software and Affected Versions Volmarg Personal Management System affected versions not specified Description Authenticated attackers can read arbitrary files by providing absolute filesystem paths to the 'GET /public/get-file/path' endpoint. This occurs because the path...

PT-2026-82465

Unauthenticated PHP Object Injection in Hash Form = 1.4.1 versions...

CVE-2026-37068

Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected endpoint...