WordPress Frontend Admin by DynamiApps plugin <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifier vulnerability

Unauthenticated Account Takeover via 'acfobjects' Object Identifier vulnerability discovered by thevietronin - GalaxyOne in WordPress Plugin Frontend Admin by DynamiApps versions = 3.29.12...

PT-2026-86922

Improper Handling of Alternate Encoding vulnerability in ash-project ash double entry allows an attacker to submit several distinct string spellings of the same identifier. AshDoubleEntry.ULID renders a 128-bit ULID as 26 Crockford base-32 characters, but the first character encodes only 3 bits, ...

MINI-2JQ8-G659-39J6

Bulletin has no description...

CVE-2026-75816 Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifier

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the preupdatevalue function lacking any capability or ownership check, and ActionPost::conditionslogic short-circuiting it...

MINI-QFRM-G6X5-3RCF

Bulletin has no description...

MINI-V4XJ-6FMG-QP3M

Bulletin has no description...

MINI-R4Q5-9RX9-FFMG

Bulletin has no description...

MINI-343Q-V7PW-R7GH

Bulletin has no description...

MINI-H3CV-JP93-CQ4C

Bulletin has no description...

MINI-XF2W-3G72-82GX

Bulletin has no description...

MINI-CHF7-P5V9-275R

Bulletin has no description...

MINI-R2F7-J845-4P75

Bulletin has no description...

MINI-6WCG-95J7-M3CJ

Bulletin has no description...

CVE-2026-84221

The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to append arbitrary SQL and read the contents of the database, including user credentials...

ROOT-OS-UBUNTU-2404-CVE-2025-71162 CVE-2025-71162 in linux - Patched by Root

Root has patched CVE-2025-71162 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available...

EUVD-2026-71862

The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to append arbitrary SQL and read the contents of the database, including user credentials...

ROOT-OS-UBUNTU-2204-CVE-2026-23121 CVE-2026-23121 in linux - Patched by Root

Root has patched CVE-2026-23121 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available...

MINI-6CH5-FQ38-P9VC

Bulletin has no description...

MINI-682G-764H-836V

Bulletin has no description...

PT-2026-86346

🚨 CVE-2026-84221 The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to append arbitrary SQL and read the contents of the database, including user credentials. 🎖@cveNotify...