44433 matches found
WordPress Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin <= 1.6.12.10 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure vulnerability
WordPress Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin = 1.6.12.10 - Authenticated Contributor+ Insecure Direct Object Reference to Sensitive Information Exposure vulnerability discovered by Michael Iden Mickhat - Hack The Box in WordPress Plugin Simply Schedu...
PT-2026-77132
Name of the Vulnerable Software and Affected Versions TaxoPress versions prior to 3.51.1 Description TaxoPress is subject to an object injection issue caused by the deserialization of untrusted data. This occurs when the application processes specially crafted serialized data, allowing an attacke...
PT-2026-77082
Subscriber Insecure Direct Object References IDOR in WP Crowdfunding 2.2.1 versions...
Linux Distros Unpatched Vulnerability : CVE-2026-72358
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: prevent invalid cursor access for purged BOs During a page table walk for binding...
Linux Distros Unpatched Vulnerability : CVE-2026-74381
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gpu: host1x: Allow entries in BO caches to be freed When a buffer object is pinned via host1xbopin with a cache, the resulting mapping is kept in the cache so i...
CVE-2026-73380: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Popup by Supsystic = 1.13.0 versions...
PT-2026-80245
Summary A guest mruby script running inside the Kobako sandbox can execute arbitrary Ruby in the host process, fully escaping the sandbox. Details A host embeds bound "Service" objects that guest scripts call across the wasm boundary through the transport dispatcher. The dispatcher passed the...
PT-2026-77086
Unauthenticated PHP Object Injection in RegistrationMagic = 6.0.9.7 versions...
PT-2026-77047
Unauthenticated PHP Object Injection in FundEngine = 1.7.9 versions...
CVE-2026-74012: Deserialization of Untrusted Data
Editor PHP Object Injection in TaxoPress = 3.51.0 versions...
CVE-2026-32470: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in FundEngine = 1.7.9 versions...
PT-2026-77156
Name of the Vulnerable Software and Affected Versions Red Hat Advanced Cluster Management for Kubernetes affected versions not specified Description A flaw in the must-gather component allows the cluster Proxy object to be dumped in raw form. This process bypasses the oc inspect redaction mechani...
CVE-2026-66620: Deserialization of Untrusted Data
Editor PHP Object Injection in OptionTree = 2.7.3 versions...
CVE-2026-73376: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic 1.5.0 versions...
CVE-2026-32465: Deserialization of Untrusted Data
Customer PHP Object Injection in Essential Real Estate = 5.3.3 versions...
PT-2026-77102
Unauthenticated PHP Object Injection in Easy Google Maps = 1.13.0 versions...
PT-2026-77105
Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic 1.5.0 versions...
PT-2026-77043
Customer PHP Object Injection in Essential Real Estate = 5.3.3 versions...