PT-2026-97707

The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP chain is present in the wpForo Forum...

PT-2026-97986

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ksmbd module where the Virtual File System VFS initializes a child's POSIX Access Control List ACL using the parent's default ACL and the requested creation mode...

PT-2026-98145

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0 Description An authenticated user with file-management access can upload malicious XML and XSLT Extensible Stylesheet Language Transformations attachments. The API endpoint 'GET /api/v1/object type/id/files/fil...

CVE-2026-97409: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nvme-fc: Do not cancel requests in io target before it is initialized A new nvme-fc controller in CONNECTING state sees admin request timeout schedules ctrl-ioerrwork to abort inflight requests. This ends up calling...

CVE-2026-97450

In the Linux kernel, the following vulnerability has been resolved: ACPICA: validate handler object type in two places ACPICA: validate handler object type in acpievhasdefaulthandler and acpievfindregionhandler...

CVE-2026-97450: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ACPICA: validate handler object type in two places ACPICA: validate handler object type in acpievhasdefaulthandler and acpievfindregionhandler...

PT-2026-98086

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ACPICA Advanced Configuration and Power Interface Component Architecture component where invalid references could be added. Specifically, the acpi ut copy simple...

CVE-2026-74991: Improper Access Control

The WPForms WordPress plugin before 2.0.2 does not verify that a Stripe payment object supplied during a public form submission belongs to it before acting on it, allowing unauthenticated users to trigger a full refund and an immediate subscription cancellation against payments created by other...

PT-2026-104959

In the Linux kernel, the following vulnerability has been resolved: ACPICA: validate handler object type in two places ACPICA: validate handler object type in acpi ev has default handler and acpi ev find region handler...

CVE-2026-77415

A flaw was found in JSONata, a JSON query and transformation language. A remote attacker could exploit multiple object-integrity weaknesses by crafting malicious JSONata expressions. This could lead to arbitrary code execution with the privileges of the host process, allowing the attacker to take...

CVE-2026-95603

Shop manager PHP Object Injection in Reycob Product Import Export = 2.3.0 versions...

CVE-2026-76087

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submit action in SubmissionsController::actionSubmit trusts a client-supplied submissionId when loading an incomplete submission without session binding, ownership validation, or a...

EUVD-2026-85547

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submit action in SubmissionsController::actionSubmit trusts a client-supplied submissionId when loading an incomplete submission without session binding, ownership validation, or a...

EUVD-2026-85506

Shop manager PHP Object Injection in Reycob Product Import Export = 2.3.0 versions...

CVE-2026-95603 WordPress Reycob Product Import Export plugin <= 2.3.0 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in Reycob Product Import Export = 2.3.0 versions...

CVE-2026-95603 WordPress Reycob Product Import Export plugin <= 2.3.0 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in Reycob Product Import Export = 2.3.0 versions...

CVE-2026-95603

The Reycob Product Import Export plugin for WordPress, specifically versions

EUVD-2026-85529

Contributor Insecure Direct Object References IDOR in SiteSkite = 2.1.7 versions...

CVE-2026-93513

The SiteSkite WordPress plugin, versions

WordPress Reycob Product Import Export plugin <= 2.3.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Reycob Product Import Export versions = 2.3.0...