CVE-2026-82358

RT-Labs AB C-Open CANopen contains a write protection bypass in the SDO server implementation (src/co_sdo_server.c ). The vulnerability occurs because the system fails to properly validate write permissions when processing download-segment frames . An unauthenticated attacker on the CAN bus can i...

CVE-2026-29782-OpenSTAManager-RCE

CVE-2026-29782 — OpenSTAManager auth-SQLi → PHPオブジェクトインジェクション → RCE OpenSTAManager ≤ 2.10.1 におけるリモートコード実行 のPoC。 oauth2.php は、攻撃者が制御する state GETパラメータによって zzoauth2 行を検索し、その accesstoken カラムに対して allowedclasses の制限なしで unserialize を呼び出します（Models\OAuth2::checkTokens /...

f_hid-4.14-backports

fhid backports for Linux 4.14.190 SM-A525F Three fixes to drivers/usb/gadget/function/fhid.c, carried by hand to a 4.14.190 Android vendor kernel and verified on the device they run on. 4.14 is end-of-life. No stable backport exists for any of these, and none is coming. That is the whole reason...

cve-2026-39440-funnelforms-fix

CVE-2026-39440 FunnelForms 修正プラグイン FunnelForms Pro ≤ 3.8.1 の脆弱なデモインポートハンドラをブロックし、リモートコード実行（CVE-2026-39440、CVSS 9.9） を緩和するドロップイン WordPress プラグインです。 脆弱性の概要 フィールド| 値 ---|--- CVE ID| CVE-2026-39440 CVSS スコア| 9.9（Critical） 影響を受ける| FunnelForms Pro ≤ 3.8.1 必要な権限| 低（購読者レベル） 種別| コードインジェクション →...

PYSEC-2026-4041 djust has broken object-level access control (IDOR)

Impact djust's per-object authorization getobject + hasobjectpermission, ADR-017 was enforced on the WebSocket mount and event paths but not on three other render entry points: a the initial HTTP GET render, b SPA urlchange navigation, and c % liverender % embedded child views. An authenticated...

djust has broken object-level access control (IDOR)

Impactdjust's per-object authorization getobject + hasobjectpermission, ADR-017 was enforced on the WebSocket mount and event paths but not on three other render entry points: a the initial HTTP GET render, b SPA urlchange navigation, and c % liverender % embedded child views. An authenticated us...

Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value

Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value SummaryCalendar events carry a free-form meta object that is stored exactly as submitted, with no validation of the values inside it. The scheduler reads the per-event alert offset out of that object i...

GHSA-633R-HQ9M-C4FF vm2: vm.freeze()/vm.readonly() bypass via accessor descriptor

Summary Untrusted JavaScript running inside new VM.run / new NodeVM.run can bypass vm.freeze / vm.readonly and mutate a host object the embedder explicitly marked read-only - the documented contract is "prevent sandboxed scripts from adding, changing, or deleting properties". If the frozen host...

CVE-2026-97284

Contributor PHP Object Injection in Icegram = 3.1.31 versions...

CVE-2026-94390

Editor PHP Object Injection in Hide Shipping Method For WooCommerce = 1.5.4 versions...

@fdm-monster/server (>=2.0.11, <=2.1.1), @objectif-lune/node-red-contrib-ftp (>=1.1.0, <=1.2.0) +2 more potentially affected by CVE-2026-102990 via basic-ftp (>=6.0.1, <=6.2.0)

basic-ftp NPM version =6.0.1, =2.0.11, =1.1.0, =1.0.0, =2.0.3-beta, =2.1.4-1257-beta.1 Source cves: CVE-2026-102990 Source advisory: OSV:GHSA-C475-QRG2-PJ4R...

CVE-2026-97284 WordPress Icegram plugin <= 3.1.31 - PHP Object Injection vulnerability

Contributor PHP Object Injection in Icegram = 3.1.31 versions...

CVE-2026-97284

The WordPress Icegram plugin (versions

EUVD-2026-90840

Contributor PHP Object Injection in Icegram = 3.1.31 versions...

CVE-2026-97284 WordPress Icegram plugin <= 3.1.31 - PHP Object Injection vulnerability

Contributor PHP Object Injection in Icegram = 3.1.31 versions...

CVE-2026-94390

The Hide Shipping Method For WooCommerce plugin for WordPress versions

CVE-2026-94390 WordPress Hide Shipping Method For WooCommerce plugin <= 1.5.4 - PHP Object Injection vulnerability

Editor PHP Object Injection in Hide Shipping Method For WooCommerce = 1.5.4 versions...

CVE-2026-94390 WordPress Hide Shipping Method For WooCommerce plugin <= 1.5.4 - PHP Object Injection vulnerability

Editor PHP Object Injection in Hide Shipping Method For WooCommerce = 1.5.4 versions...

EUVD-2026-90854

Editor PHP Object Injection in Hide Shipping Method For WooCommerce = 1.5.4 versions...

WordPress Hide Shipping Method For WooCommerce plugin <= 1.5.4 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Hide Shipping Method For WooCommerce versions = 1.5.4...