EUVD-2026-84393

A flaw has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. This issue affects the function moveuploadedfile of the file filemanager.php. Executing a manipulation of the argument files can lead to unrestricted upload. The attack can be executed remotely. The vendor was...

CVE-2026-95499

CVE-2026-95499 affects JosephChuks php-file-manager-with-code-editor up to version 3.0 . The flaw resides in the move_uploaded_file function within filemanager.php , where manipulation of the files argument permits unrestricted file upload by a remote, unauthenticated attacker. The CVSS v3.1 base...

CVE-2026-95674 MISP EventsController queryEnrichment allows querying unavailable or legacy modules without validation

In MISP, the queryEnrichment method in EventsController.php accepted a module name parameter and iterated over the list of enabled modules to find a match. If the specified module was not present in the enabled modules list, the code silently continued processing using default parameters format s...

WordPress Give Tributes plugin <= 2.3.1 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Voyag3r-Security in WordPress Plugin Give Tributes versions = 2.3.1...

WordPress Unlimited Elements For Elementor plugin < 2.0.20 - Subscriber+ PHP Object Injection vulnerability

Subscriber+ PHP Object Injection vulnerability discovered by Jakub Herman in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions 2.0.20...

Security update for php-composer2

This update for php-composer2 fixes the following issues: CVE-2026-45793: GitHub OAuth tokens failing regex validation can cause credential disclosure bsc1271504. CVE-2026-59944: path traversal and link following issue can make files world readable and executable bsc1279898. CVE-2026-59946: packa...

SUSE-SU-2026:4283-1 Security update for php-composer2

This update for php-composer2 fixes the following issues: - CVE-2026-45793: GitHub OAuth tokens failing regex validation can cause credential disclosure bsc1271504. - CVE-2026-59944: path traversal and link following issue can make files world readable and executable bsc1279898. - CVE-2026-59946:...

CVE-2026-9231

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software for WordPress is vulnerable to Local File Inclusion (LFI) in all versions up to and including 6.8.0 . The root cause lies in the wte_get_template function, which allows authenticated attackers with contributor-level access or hig...

EUVD-2026-84333

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.8.0 via the wtegettemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, ...

CVE-2026-91827

The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to CSV, allowing unauthenticated attackers to perform PHP Object Injection; if a suitable POP chain is present via another install...

CVE-2026-91827 Ninja Forms 3.15.3 - Unauthenticated PHP Object Injection via CSV Export

The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to CSV, allowing unauthenticated attackers to perform PHP Object Injection; if a suitable POP chain is present via another install...

CVE-2026-91827 Ninja Forms 3.15.3 - Unauthenticated PHP Object Injection via CSV Export

The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to CSV, allowing unauthenticated attackers to perform PHP Object Injection; if a suitable POP chain is present via another install...

CVE-2026-91827

The Ninja Forms WordPress plugin (version 3.15.3 ) is vulnerable to unauthenticated PHP Object Injection . User-submitted form field values are deserialised without sanitisation when an administrator exports form submissions to CSV . Exploitation requires user interaction (an admin performing the...

EUVD-2026-84283

The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to CSV, allowing unauthenticated attackers to perform PHP Object Injection; if a suitable POP chain is present via another install...

Exploit for CVE-2026-19658

CVE-2026-19658 — Give Tributes Unauthenticated PHP Object Inje...

CVE-2026-19658

The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.1 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software,...

CVE-2026-19658

Give Tributes WordPress plugin (≤ 2.3.1 ) is vulnerable to PHP Object Injection via deserialization of untrusted input in the give_tributes_ecard_notify[recipient][personalized][] parameter, exploitable by unauthenticated attackers. No known POP chain exists within the plugin itself, so impact de...

EUVD-2026-84269

The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.1 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software,...

CVE-2026-19658 Give Tributes <= 2.3.1 - Unauthenticated PHP Object Injection via 'give_tributes_ecard_notify[recipient][personalized][]' Parameter

The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.1 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software,...

CVE-2026-19658 Give Tributes <= 2.3.1 - Unauthenticated PHP Object Injection via 'give_tributes_ecard_notify[recipient][personalized][]' Parameter

The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.1 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software,...