CVE-2026-86732

Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to instantiate arbitrary classes through the criteria parameter. Attackers can inject a malicious class via criteriawithTransforms0class that...

CVE-2026-86734

Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST /account/accept/acceptance endpoint, allowing authenticated users to submit unbounded input that reaches synchronous CommonMark rendering. Attackers can submit large note values to exhaust PHP worker CPU and cause...

EUVD-2026-72868

Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to instantiate arbitrary classes through the criteria parameter. Attackers can inject a malicious class via criteriawithTransforms0class that...

CVE-2026-86732

Craft CMS versions before 5.10.12 contain a Remote Code Execution vulnerability in the element-index endpoint. Authenticated content editors can instantiate arbitrary classes by injecting a malicious class via criteria[withTransforms][0][class], which reaches ImageTransforms::normalizeTransform()...

CVE-2026-86732 Craft CMS before 5.10.12 Remote Code Execution via element-index

Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to instantiate arbitrary classes through the criteria parameter. Attackers can inject a malicious class via criteriawithTransforms0class that...

CVE-2026-86732 Craft CMS before 5.10.12 Remote Code Execution via element-index

Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to instantiate arbitrary classes through the criteria parameter. Attackers can inject a malicious class via criteriawithTransforms0class that...

CVE-2026-86732 Craft CMS before 5.10.12 Remote Code Execution via element-index

Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to instantiate arbitrary classes through the criteria parameter. Attackers can inject a malicious class via criteriawithTransforms0class that...

WordPress Ninja Forms – The Contact Form Builder That Grows With You plugin <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection vulnerability

Authenticated Administrator+ PHP Object Injection vulnerability discovered by Hermione in WordPress Plugin Ninja Forms versions = 3.14.6...

CVE-2026-73321

XenForo before 2.3.13 contains an uncontrolled recursion vulnerability in the BBCode parser that allows authenticated attackers to cause persistent denial of service by submitting a post with deeply nested BBCode tags. Attackers can craft a single malicious post with sufficient nesting depth to...

CVE-2026-73309

XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint that allows unauthenticated attackers to obtain valid token pairs by submitting empty values for clientsecret and codeverifier parameters. Attackers can exploit PHP truthy evaluation logic, which...

CVE-2026-73321 XenForo < 2.3.13 Uncontrolled Recursion DoS via BBCode Parser

XenForo before 2.3.13 contains an uncontrolled recursion vulnerability in the BBCode parser that allows authenticated attackers to cause persistent denial of service by submitting a post with deeply nested BBCode tags. Attackers can craft a single malicious post with sufficient nesting depth to...

CVE-2026-73321

XenForo before 2.3.13 contains an uncontrolled recursion vulnerability in the BBCode parser . Authenticated attackers can submit a single post with deeply nested BBCode tags sufficient to exceed PHP's stack limit, causing fatal errors that repeatedly terminate PHP-FPM workers for all visitors ren...

EUVD-2026-72758

XenForo before 2.3.13 contains an uncontrolled recursion vulnerability in the BBCode parser that allows authenticated attackers to cause persistent denial of service by submitting a post with deeply nested BBCode tags. Attackers can craft a single malicious post with sufficient nesting depth to...

CVE-2026-73309 XenForo < 2.3.13 Authentication Bypass via OAuth2 Token Endpoint

XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint that allows unauthenticated attackers to obtain valid token pairs by submitting empty values for clientsecret and codeverifier parameters. Attackers can exploit PHP truthy evaluation logic, which...

CVE-2026-73309 XenForo < 2.3.13 Authentication Bypass via OAuth2 Token Endpoint

XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint that allows unauthenticated attackers to obtain valid token pairs by submitting empty values for clientsecret and codeverifier parameters. Attackers can exploit PHP truthy evaluation logic, which...

CVE-2026-73309

XenForo before 2.3.13 is vulnerable to an authentication bypass in its OAuth2 token endpoint . An unauthenticated attacker can submit empty strings for the client_secret and code_verifier parameters; because PHP truthy evaluation treats empty strings as falsy, both the client secret check and the...

EUVD-2026-72780

XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint that allows unauthenticated attackers to obtain valid token pairs by submitting empty values for clientsecret and codeverifier parameters. Attackers can exploit PHP truthy evaluation logic, which...

CVE-2026-16502

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to injec...

CVE-2026-16502

The Live Composer – Free WordPress Website Builder plugin (versions ≤ 2.1.18) is vulnerable to PHP Object Injection via deserialization of untrusted input introduced through a shortcode. Authenticated attackers with contributor-level access or above can inject a PHP object. Critically, no known P...

EUVD-2026-72695

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to injec...