44854 matches found
EUVD-2026-48204
Unauthenticated Insecure Direct Object References IDOR in Easy Appointments = 3.12.27 versions...
CVE-2026-61946
WordPress Easy Appointments plugin
EUVD-2026-48197
Unauthenticated PHP Object Injection in Thrive Quiz Builder = 10.9.3.0 versions...
CVE-2026-59544
The CVE covers WordPress Thrive Quiz Builder plugin versions
CVE-2026-59544 WordPress Thrive Quiz Builder plugin <= 10.9.3.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Thrive Quiz Builder = 10.9.3.0 versions...
CVE-2026-59544 WordPress Thrive Quiz Builder plugin <= 10.9.3.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Thrive Quiz Builder = 10.9.3.0 versions...
Astra Linux – Vulnerability in Chromium
Before version 148.0.7778.96, using free after in the DOM in Google Chrome allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: High...
WordPress Dokan Pro plugin <= 5.0.2 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Expatch in WordPress Plugin Dokan Pro versions = 5.0.2...
PT-2026-63914
Subscriber PHP Object Injection in Dokan Pro = 5.0.2 versions...
PT-2026-63918
Administrator PHP Object Injection in Complianz = 7.5.0 versions...
CVE-2026-65493: Deserialization of Untrusted Data
Subscriber PHP Object Injection in Dokan Pro = 5.0.2 versions...
PT-2026-63885
Subscriber Insecure Direct Object References IDOR in Masteriyo - LMS = 2.3.1 versions...
PT-2026-71920
Name of the Vulnerable Software and Affected Versions next-auth versions 5.0.0-beta.0 through 5.0.0-beta.31 Description Applications using the auth wrapper to gate access by checking only for the existence of the returned object can fail open during server configuration errors. In middleware, Rou...
PT-2026-64023
CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference IDOR vulnerability in the IncBackups application's incremental-backup handlers deleteBackup, fetchRestorePoints, and restorePoint that allows authenticated panel users to access or manipulate other...
PT-2026-63879
Contributor Insecure Direct Object References IDOR in Product Slider for WooCommerce = 1.13.62 versions...
CVE-2026-59544: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Thrive Quiz Builder = 10.9.3.0 versions...
AzeoTech DAQFactory CTL File Parsing Use-After-Free Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of AzeoTech DAQFactory. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of...
PT-2026-67356
Impact next-auth Auth.js v5 applications that gate access by checking only for the existence of the auth object — the pattern shown in the official session management / protecting resources guide — are affected. When the Auth.js configuration produces a server-side error, the auth object exposed ...
PT-2026-64141
Impact The /internal/object storage endpoint accepts a caller-supplied JSON storage path parameter that dynamically overrides the TensorZero object storage configuration. By abusing the filesystem storage type, a caller can read arbitrary files from the gateway filesystem, including files that ma...