WordPress TaxoPress plugin <= 3.51.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by daroo in WordPress Plugin TaxoPress versions = 3.51.0...

BIT-KIBANA-2026-72681 Missing Authorization in Kibana Leading to Privilege Escalation and Information Disclosure

Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes that feature's functionality. This allows privilege escalation and could lead to disclosure of sensitive information th...

WordPress Kalles Addons plugin <= 1.0.6 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Kalles Addons versions = 1.0.6...

CVE-2026-58372

A flaw was found in SeaweedFS. An authenticated remote attacker with write access to a single bucket could exploit a path traversal vulnerability in the S3 gateway. By crafting a DeleteObjects XML request body with specific object keys containing directory traversal sequences, the attacker could...

WordPress Flexible Subscriptions plugin <= 1.8.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Van Phuc in WordPress Plugin Flexible Subscriptions versions = 1.8.1...

CVE-2026-76263: Authorization Bypass Through User-Controlled Key

In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete Splunk Processing Language version 2 SPL2 modules belonging to other users through the data management orchestrator interface. The vulnerability does not affect Splunk...

PT-2026-78452

Joomla Extension - cmsjunkie.com - Open mail relay in J-BusinessDirectory 6.2.3 - Recipient address was taken from the request contact id offer / contact id event instead of the server-side offer/event record, so mail could be sent to an arbitrary address...

PT-2026-78800

In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could inject crafted input into an Active Directory query to enumerate Active Directory objects, including accounts, groups, and organizational units, read sensitive attributes from...

CVE-2026-75951: Authorization Bypass Through User-Controlled Key

Joomla Extension - cmsjunkie.com - Insecure Direct Object Reference multiple frontend/API actions in J-BusinessDirectory 6.2.3...

PT-2026-78450

Joomla Extension - cmsjunkie.com - Insecure Direct Object Reference multiple frontend/API actions in J-BusinessDirectory 6.2.3...

CVE-2026-73364: Deserialization of Untrusted Data

Customer PHP Object Injection in Flexible Subscriptions = 1.8.1 versions...

PT-2026-78340

Customer PHP Object Injection in Flexible Subscriptions = 1.8.1 versions...

PT-2026-78735

In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete Splunk Processing Language version 2 SPL2 modules belonging to other users through the data management orchestrator interface. The vulnerability does not affect Splunk...

PT-2026-78346

Name of the Vulnerable Software and Affected Versions Kalles Addons versions prior to 1.0.7 Description An unauthenticated PHP Object Injection issue exists. PHP Object Injection occurs when untrusted input is passed to the unserialize function, allowing an attacker to manipulate serialized objec...

CVE-2026-76238: Incorrect Authorization

stigmem versions before 0.9.0a12 contain a broken object level authorization vulnerability in the decay sweep endpoint that allows authenticated attackers with write credentials for one tenant to execute decay operations affecting all tenants. Attackers can submit POST requests to the decay sweep...

CVE-2026-73389: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Kalles Addons = 1.0.6 versions...

CVE-2026-76325: Improper Neutralization of Input During Web Page Generation

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a malicious ui-tour knowledge object that matches an auto-tour page name and share the object at the app level. The object can execute arbitrary JavaScript in the browser o...

CVE-2026-76237: Authorization Bypass Through User-Controlled Key

stigmem-node before 0.9.0a12 contains a broken object level authorization cross-tenant BOLA vulnerability in the quarantine review endpoints. On multi-tenant deployments running the opt-in stigmem-plugin-multi-tenant, the list/count queries and getquarantinedfact in routes/quarantine.py lacked a...

PT-2026-78417

Name of the Vulnerable Software and Affected Versions stigmem-node versions prior to 0.9.0a12 Description A broken object level authorization BOLA flaw exists in the right-to-be-forgotten RTBF tombstone mechanism. The issue tombstone function defaulted the tenant to "default" instead of the...

EUVD-2026-61098

Kurrier is a modern, self-hosted workspace for email, calendar, contacts, and storage. Prior to 1.2.4, Kurrier API endpoints for listing and retrieving webhook and identity resources did not enforce ownership checks for authenticated API requests. An attacker with a valid API key could use anothe...