PT-2026-63918

Administrator PHP Object Injection in Complianz = 7.5.0 versions...

CVE-2026-65493: Deserialization of Untrusted Data

Subscriber PHP Object Injection in Dokan Pro = 5.0.2 versions...

PT-2026-63885

Subscriber Insecure Direct Object References IDOR in Masteriyo - LMS = 2.3.1 versions...

PT-2026-71920

Name of the Vulnerable Software and Affected Versions next-auth versions 5.0.0-beta.0 through 5.0.0-beta.31 Description Applications using the auth wrapper to gate access by checking only for the existence of the returned object can fail open during server configuration errors. In middleware, Rou...

PT-2026-64023

CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference IDOR vulnerability in the IncBackups application's incremental-backup handlers deleteBackup, fetchRestorePoints, and restorePoint that allows authenticated panel users to access or manipulate other...

PT-2026-63879

Contributor Insecure Direct Object References IDOR in Product Slider for WooCommerce = 1.13.62 versions...

jq Heap Buffer Overflow DoS

The vulnerability of the jvobjectmergerecursive function in the jq JSON processing tool is related to an uncontrolled recursion. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-59544: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Thrive Quiz Builder = 10.9.3.0 versions...

AzeoTech DAQFactory CTL File Parsing Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of AzeoTech DAQFactory. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of...

PT-2026-67356

Impact next-auth Auth.js v5 applications that gate access by checking only for the existence of the auth object — the pattern shown in the official session management / protecting resources guide — are affected. When the Auth.js configuration produces a server-side error, the auth object exposed ...

PT-2026-64141

Impact The /internal/object storage endpoint accepts a caller-supplied JSON storage path parameter that dynamically overrides the TensorZero object storage configuration. By abusing the filesystem storage type, a caller can read arbitrary files from the gateway filesystem, including files that ma...

PT-2026-63922

Unauthenticated Insecure Direct Object References IDOR in Shiptastic for WooCommerce = 5.1.0 versions...

CVE-2026-65497: Deserialization of Untrusted Data

Administrator PHP Object Injection in Complianz = 7.5.0 versions...

PT-2026-63862

Unauthenticated Insecure Direct Object References IDOR in Easy Appointments = 3.12.27 versions...

PT-2026-63855

Unauthenticated PHP Object Injection in Thrive Quiz Builder = 10.9.3.0 versions...

Oracle E-Business Suite (July 2026 CPU)

The versions of Oracle E-Business Suite installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite component: Internal Operations. Supported versions that are...

Prototype Pollution

Overview n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to Prototype Pollution via the Edit Fields Set process when output fields are assigned using dot-notation path setters without restricting field names. An attacker can corrupt a shared global in the ma...

EUVD-2026-42612

n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration...

WordPress Shiptastic for WooCommerce plugin <= 5.1.0 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Guillermo Álvarez in WordPress Plugin Shiptastic for WooCommerce versions = 5.1.0...

GO-2026-6029 Gitea: Git LFS object reuse allows non-Code access to authorize private source objects in code.gitea.io/gitea

Gitea: Git LFS object reuse allows non-Code access to authorize private source objects in code.gitea.io/gitea...