PT-2026-84777

In Stapler 2107.v8dfcb e8ed317 and earlier, except 2088.2093.vd7c3e58008a 6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static fields of the bound configuration object, allowing attackers who can submit configuration forms to modify...

PT-2026-84572

A security vulnerability has been detected in gouguoa up to 5.10.0/6.0.1. This vulnerability affects the function update of the file app/home/controller/Index.php of the component edit personal Endpoint. Such manipulation of the argument position id leads to dynamically-determined object...

PT-2026-84701

Unauthenticated Insecure Direct Object References IDOR in PublishPress Permissions = 4.8.3 versions...

CVE-2023-3360: Deserialization of Untrusted Data

The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is present on the blog...

CVE-2026-81772: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Ninja Forms - Layout & Styles = 3.0.31 versions...

PT-2026-84719

The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its custom staff role to modify, disable, or take over appointments belonging to other staff members...

PT-2026-84769

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML...

CVE-2026-19116: Deserialization of Untrusted Data

The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing authenticated users with subscriber-level access and above to perform PHP Object Injection, which may lead ...

Form submission data binding can set static fields

Jenkins uses the https://github.com/jenkinsci/staplerStapler web framework for HTTP request handling. In Stapler 2107.v8dfcbe8ed317 and earlier, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static fields of...

PT-2026-84770

In Stapler 2107.v8dfcb e8ed317 and earlier, except 2088.2093.vd7c3e58008a 6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Stapler does not restrict the types of objects that can be instantiated via form data binding to those compatible with the expected field type, allowing...

Linux Distros Unpatched Vulnerability : CVE-2026-83557

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom...

CVE-2026-81283: Deserialization of Untrusted Data

Subscriber PHP Object Injection in WP User Frontend = 4.3.10 versions...

CVE-2026-84367

joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.5 and 18.2.4, joi's lib/types/keys.js internals.rename implementation used by object.rename permits a schema that renames keys with a regular-expression source and a Joi.expression or Joi.x target that...

CVE-2026-71981

Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the backquery GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload...

EUVD-2026-69650

Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the backquery GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload...

CVE-2026-71981

Cypht versions before 2.12.2 contain a PHP object injection vulnerability in the logout handler. The back_query GET parameter accepts a base64-encoded serialized payload that is passed directly to unserialize() without an allow-list, signature check, or type restriction, enabling gadget-chain exp...

CVE-2026-71981 Cypht < 2.12.2 PHP Object Injection RCE via back_query Parameter

Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the backquery GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload...

CVE-2026-71981 Cypht < 2.12.2 PHP Object Injection RCE via back_query Parameter

Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the backquery GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload...

CVE-2026-71981 Cypht < 2.12.2 PHP Object Injection RCE via back_query Parameter

Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the backquery GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload...

CVE-2026-84367

joi (a JavaScript schema validator) is vulnerable to a limited prototype pollution via object().rename() in versions 16.0.0 through 17.13.4 and 18.2.3 . The root cause lies in internals.rename() in lib/types/keys.js: when a schema uses a regular-expression source combined with a Joi.expression() ...