CVE-2026-86817: Exposure of Sensitive Information to an Unauthorized Actor

The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema field default values, allowing authenticated users with Author-level access and above to store input that discloses sensitive data, including other users' passwo...

PT-2026-104609

Name of the Vulnerable Software and Affected Versions Five Star Business Profile and Schema WordPress plugin versions prior to 2.4.0 Description Insufficient restriction of callbacks used to resolve schema field default values allows authenticated users with Author-level access and above to store...

[SECURITY] Fedora 45 Update: docbook5-schemas-5.1-19.fc45

Docbook 5.X is a complete rewrite of Docbook in RELAX NG and not compatible with previous Docbook versions. This package contains Relax NG , DTD and W3C schema for Docbook 5.X. Syntax of those schemas is XML-compliant and is developed by the OASIS consortium...

CVE-2026-103877

A flaw was found in Apache Directory LDAP API. When a client calls loadSchema to search an LDAP server's subschema, a rogue or compromised server, or a network attacker able to intercept the connection before TLS is established, can return a crafted schema object containing a serialized Java clas...

CVE-2026-103036

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSchemaCoercer to collect object properties in a plain object and to resolve schema.properties entries through the prototype chain...

CVE-2026-103036 @orpc/json-schema: Prototype injection in smart coercion

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSchemaCoercer to collect object properties in a plain object and to resolve schema.properties entries through the prototype chain...

CVE-2026-103036 @orpc/json-schema: Prototype injection in smart coercion

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSchemaCoercer to collect object properties in a plain object and to resolve schema.properties entries through the prototype chain...

CVE-2026-103036 @orpc/json-schema: Prototype injection in smart coercion

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSchemaCoercer to collect object properties in a plain object and to resolve schema.properties entries through the prototype chain...

CVE-2026-103036

The oRPC tool (specifically the @orpc/json-schema SmartCoercionPlugin ) is vulnerable to a prototype injection issue in versions prior to 1.14.9 . The root cause is the use of JsonSchemaCoercer to resolve schema.properties entries through the prototype chain. A remote client can supply __proto__ ...

EUVD-2026-91791

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSchemaCoercer to collect object properties in a plain object and to resolve schema.properties entries through the prototype chain...

agents-schema (>=0.0.8, <=0.0.11), ai-trustgraph (>=0.1.0, <=0.2.2) +244 more potentially affected by CVE-2026-94654 via thrift (>=0.11.0, <=0.24.0)

thrift PYPI version =0.11.0, =0.0.8, =0.1.0, =0.1.0, =0.0.1, =1.0.1, =0.1.0, =0.13.3, =0.6.6, =1.0.6, =2.7.0rc1, =0.1.0, =0.0.32, =0.1.9, =0.1.0, =0.1.1 and more Source cves: CVE-2026-94654 Source advisory: MEND:CVE-2026-94654...

CVE-2026-103877 Apache Directory LDAP API: Unsafe loading of Java code from LDAP schema elements

Deserialization of Untrusted Data vulnerability in Apache Directory LDAP API. A rogue/compromised LDAP server or pre-TLS MITM can answer a client's loadSchema subschema search with a schema object that contains a serialized Java class, allowing some potential RCE. This issue affects Apache...

PT-2026-104427

Name of the Vulnerable Software and Affected Versions oRPC versions prior to 1.14.9 Description The @orpc/json-schema SmartCoercionPlugin utilizes JsonSchemaCoercer to collect object properties in a plain object and resolve schema.properties entries via the prototype chain. A remote client...

CVE-2026-103036: Improperly Controlled Modification of Dynamically-Determined Object Attributes

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSchemaCoercer to collect object properties in a plain object and to resolve schema.properties entries through the prototype chain...

Linux Distros Unpatched Vulnerability : CVE-2023-54404

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Zod schema-validation library through 4.6.5 contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a...

Improper Certificate Validation

Overview confluent-kafka is a high-level Producer, Consumer and AdminClient compatible with all Apache KafkaTM broker Affected versions of this package are vulnerable to Improper Certificate Validation in HcVaultKmsClient.init in...

CVE-2023-54404 Zod 4.6.5 Uncontrolled Resource Consumption via Array Validation

Zod schema-validation library through 4.6.5, fixed in commit e06a510, contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema without a length constraint. Attackers can exploit the...

CVE-2026-97280

Missing Authorization vulnerability in Mamunur Rashid Review Schema review-schema allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Review Schema: 3.1.0...

CVE-2026-97280

The Review Schema WordPress plugin (version 3.1.0 ) is vulnerable to a Missing Authorization flaw (CWE-862). This Broken Access Control vulnerability allows an attacker to exploit incorrectly configured access control security levels . The vulnerability impacts the integrity and availability of t...

CVE-2026-97280 WordPress Review Schema plugin 3.1.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Mamunur Rashid Review Schema review-schema allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Review Schema: 3.1.0...