Exploit for CVE-2026-84753

abraxaslabs.tech · github.com/abraxas ·&...

CVE-2026-84902

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform an object-level authorization check when importing template content into a page, allowing users with contributor-level access and above to overwrite the Elementor content of arbitrary posts and pages, including those...

CVE-2026-84904

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gating them only on a coarse capability that lower-privileged users also hold and never confirming ownership of the targeted object, allowing...

CVE-2026-17086

The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.5.5 via deserialization of untrusted input . This makes it possible for authenticated attackers, with author-level access and...

EUVD-2026-82653

The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.5.5 via deserialization of untrusted input . This makes it possible for authenticated attackers, with author-level access and...

CVE-2026-17086 ShortPixel Image Optimizer <= 6.5.5 - Authenticated (Author+) PHP Object Injection via Nested JSON Post Content

The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.5.5 via deserialization of untrusted input . This makes it possible for authenticated attackers, with author-level access and...

CVE-2026-17086 ShortPixel Image Optimizer <= 6.5.5 - Authenticated (Author+) PHP Object Injection via Nested JSON Post Content

The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.5.5 via deserialization of untrusted input . This makes it possible for authenticated attackers, with author-level access and...

CVE-2026-17086

The ShortPixel Image Optimizer WordPress plugin (versions

SUSE CVE-2026-17495

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object...

CVE-2026-92714: Authorization Bypass Through User-Controlled Key

The Download Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.3.68 via the duplicate function hooked on admininit. This is due to the handler only verifying the generic 'editposts' capability and a plugin-wide static nonce NONCEKEY...

PT-2026-95519

Name of the Vulnerable Software and Affected Versions Mongoid affected versions not specified Description An insecure direct object reference exists in the nested attributes handling of the Mongoid object-document mapper. This allows a user with basic application privileges to reference a record...

PT-2026-95228

Name of the Vulnerable Software and Affected Versions ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF versions prior to 6.5.6 Description The plugin is susceptible to PHP Object Injection through the deserialization of untrusted input. This allows authenticated attackers with...

CVE-2026-17086: Deserialization of Untrusted Data

The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.5.5 via deserialization of untrusted input . This makes it possible for authenticated attackers, with author-level access and...

PT-2026-95421

Name of the Vulnerable Software and Affected Versions Netty affected versions not specified Description A flaw exists where the HTTP-object conversion path incorrectly processes specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests as regular HTTP/1.1 CONNECT requests. This misinterpretati...

PT-2026-95562

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A protection mechanism failure in the object-document mapper's encryption configuration generation allows fields intended for client-side field-level encryption ...

CVE-2026-13471: Authorization Bypass Through User-Controlled Key

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.3 via the LatePointAbilityDeleteBooking::execute due to missing validation on a user controlled key. This makes it...

PT-2026-95234

Name of the Vulnerable Software and Affected Versions King Addons for Elementor versions prior to 51.1.81 Description An issue exists where the software fails to perform an object-level authorization check during the import of template content into a page. This allows users with contributor-level...

CVE-2026-18441: Authorization Bypass Through User-Controlled Key

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.9 via the setcustomerobject due to missing validation on a user controlled key. This makes it possible...

CVE-2026-84902: Improper Neutralization of Input During Web Page Generation

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform an object-level authorization check when importing template content into a page, allowing users with contributor-level access and above to overwrite the Elementor content of arbitrary posts and pages, including those...

Linux Distros Unpatched Vulnerability : CVE-2026-93185

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ASoC: rt700-sdw: always drain jack work on remove rt700sdwremove drains jackdetectwork and jackbtncheckwork only when rt700-hwinit is true. That state bit is...