44197 matches found
CVE-2026-78257 WordPress Booking and Rental Manager plugin <= 2.7.5 - PHP Object Injection vulnerability
Contributor PHP Object Injection in Booking and Rental Manager = 2.7.5 versions...
CVE-2026-47864
SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering. Any request with Content-Type application/x-java-serialized-object whose body resolves to a Serializable type is read directly via readObject. If an...
EUVD-2026-66763
Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other customers' databases...
PT-2026-82627
Name of the Vulnerable Software and Affected Versions Flowintel versions 3.3.0 and later Description Flowintel constructs timeline HTML by directly concatenating attacker-controllable MISP object fields into HTML strings before rendering. The affected fields include the object UUID, object name,...
PT-2026-82465
Unauthenticated PHP Object Injection in Hash Form = 1.4.1 versions...
PT-2026-82624
Name of the Vulnerable Software and Affected Versions Flowintel versions 3.3.0 and earlier Description An insecure direct object reference and broken object-level authorization issue exists across multiple task endpoints. The system failed to verify if a task belonged to the provided case...
PT-2026-82490
A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as view ptables, can obtain historical template contents belonging t...
PT-2026-82387
The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not verify that the requesting user owns the customer profile being queried through one of its REST endpoints, allowing any authenticated user e.g. a customer/subscriber to...
PT-2026-82462
Unauthenticated PHP Object Injection in Geo Controller = 8.9.8 versions...
CVE-2026-78292: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Hash Form = 1.4.1 versions...
PT-2026-82451
Name of the Vulnerable Software and Affected Versions Booking and Rental Manager versions prior to 2.7.6 Description An issue exists that allows for PHP Object Injection, a technique where an attacker leverages the deserialization of untrusted data to instantiate arbitrary objects and execute...
CVE-2026-81817: Authorization Bypass Through User-Controlled Key
Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints. The routes generally received both a case identifier and a task identifier, but previously they did not enforce that the task actually belonged to t...
CVE-2026-78286: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Geo Controller = 8.9.8 versions...
CVE-2026-81820: Improper Neutralization of Input During Web Page Generation
Affected versions of Flowintel construct timeline HTML using attacker-controllable MISP object fields such as: object UUID; object name; attribute value; attribute type; comment; first/last seen values; IDS flag. Those values were concatenated directly into HTML strings before rendering. The...
PT-2026-82423
Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager 5.0.1 - A registered user with edit-own rights the eventowner=1 setting or core.edit.own can POST another user's record id together with their own id as created by an...
CVE-2026-59284: Improperly Controlled Modification of Dynamically-Determined Object Attributes
There is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled. Spring Cloud Commons 5.0.0 - 5.0.2 Spring Cloud Commons 4.3.0 - 4.3.3 Spring Cloud Commons 4.0.0 - 4.2.6 Spring Cloud Commons 3.1.10 and earlier...
CVE-2026-47850: Improperly Controlled Modification of Dynamically-Determined Object Attributes
Spring Data REST does not preserve the persisted version @Version property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20...
PT-2026-82458
Editor PHP Object Injection in Fluent Boards Pro = 2.0.11 versions...