ROOT-APP-NPM-CVE-2021-23329 CVE-2021-23329 in nested-object-assign - Patched by Root

Root has patched CVE-2021-23329 in the nested-object-assign package for Root:npm. Multiple fixed versions available...

WordPress Everest Forms plugin <= 3.6.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by LueRader in WordPress Plugin Everest Forms versions = 3.6.0...

WordPress Site Reviews plugin 7.2.2-8.2.2 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Jakub Herman in WordPress Plugin Site Reviews versions 7.2.2-8.2.2...

WordPress Weaver Show Posts plugin < 1.8.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Do Xuan Trung in WordPress Plugin Weaver Show Posts versions 1.8.1...

Exploit for CVE-2026-82222

CVE-2026-82222 — GiveWP Unauthenticated PHP Object Injection →...

WordPress Slim SEO plugin <= 4.10.0 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Sybre Waaijer in WordPress Plugin Slim SEO versions = 4.10.0...

CVE-2026-86779 Visualizer < 4.0.6 - Contributor+ Arbitrary Chart Deletion via deleteChart

The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-deletion requests, performing only a site-wide capability check with no per-object ownership verification, allowing users with the Contributor role and above to permanently delete any chart on the site, including chart...

CVE-2026-88046

A flaw was found in rclone, a command-line program for syncing files. This vulnerability allows an attacker to bypass configured directory restrictions by including parent-directory segments e.g., '..' in source object names. When a specially crafted source object is uploaded or copied, it can...

CVE-2026-11496 Woo PDF Invoice Builder <= 2.0.8 - Authenticated (Subscriber+) Insecure Direct Object Reference to Sensitive Order Information Disclosure

The Woo PDF Invoice Builder plugin also distributed as "PDF Builder for WooCommerce" for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.8. This is due to the InspectOrder AJAX handler woocommerce-pdf-invoice-ajax.php:513, registered on...

PT-2026-90497

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.5.3 Description An authorization flaw exists during Express entry submissions where the system validates the authorization check against the entity of the posted form instead of the entity identified by the...

PT-2026-90020

Unauthenticated PHP Object Injection in Everest Forms = 3.6.0 versions...

PT-2026-89913

Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.4.18 Description A mass assignment issue exists in the editer objet action. Unauthenticated attackers can write arbitrary rows to any SQL table that does not have a champs editables allowlist by providing a controlled...

PT-2026-90032

Contributor Insecure Direct Object References IDOR in Starter Templates = 4.7.5 versions...

PT-2026-89746

The Woo PDF Invoice Builder plugin also distributed as "PDF Builder for WooCommerce" for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.8. This is due to the InspectOrder AJAX handler woocommerce-pdf-invoice-ajax.php:513, registered on wp aja...

PT-2026-90023

Unauthenticated PHP Object Injection in Masteriyo - LMS = 3.4.0 versions...

PT-2026-90021

Unauthenticated PHP Object Injection in ThemeREX Addons 2.45.0 versions...

PT-2026-90311

Name of the Vulnerable Software and Affected Versions Linux kernel version 6.12.95 Description A race condition exists in the fsnotify system affecting fanotify and inotify. When a mark receives a new event bit, the system may skip recalculating the object mask if the cached aggregate already...

PT-2026-90598

Name of the Vulnerable Software and Affected Versions Tutor LMS versions prior to 4.0.8 Description The Tutor LMS plugin for WordPress is affected by a PHP Object Injection issue that can lead to remote code execution on over 100,000 sites worldwide. The flaw exists in the tutor save withdraw...

PT-2026-90126

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Netlink handlers for tunnel create, tunnel modify, session create, and session modify send multicast notifications via helpers. These helpers may fail during message allocation, encoding...

PT-2026-90163

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the iommufd access notify unmap function where internal accesses are skipped because they lack an external unmap callback. The process incorrectly calls iommufd lock o...