43721 matches found
CVE-2026-78276
CVE-2026-78276 affects the WordPress Fluent Boards Pro plugin, versions 2.0.11 and earlier , where an Editor-level user can perform PHP Object Injection , leading to potential high impact on confidentiality, integrity, and availability (CVSS 3.1 score 7.2 / HIGH ). The vulnerability is network-re...
EUVD-2026-66939
Editor PHP Object Injection in Fluent Boards Pro = 2.0.11 versions...
CVE-2026-78276 WordPress Fluent Boards Pro plugin <= 2.0.11 - PHP Object Injection vulnerability
Editor PHP Object Injection in Fluent Boards Pro = 2.0.11 versions...
CVE-2026-78257
CVE-2026-78257 is a PHP Object Injection vulnerability in the WordPress plugin Booking and Rental Manager for WooCommerce (versions ≤ 2.7.5), discovered by daroo and rated CVSS 8.8 (High) by Patchstack. The flaw allows a user with Contributor privilege to exploit the injection over the network wi...
CVE-2026-78257 WordPress Booking and Rental Manager plugin <= 2.7.5 - PHP Object Injection vulnerability
Contributor PHP Object Injection in Booking and Rental Manager = 2.7.5 versions...
EUVD-2026-66992
Contributor PHP Object Injection in Booking and Rental Manager = 2.7.5 versions...
CVE-2026-78257 WordPress Booking and Rental Manager plugin <= 2.7.5 - PHP Object Injection vulnerability
Contributor PHP Object Injection in Booking and Rental Manager = 2.7.5 versions...
CVE-2026-47864
SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering. Any request with Content-Type application/x-java-serialized-object whose body resolves to a Serializable type is read directly via readObject. If an...
EUVD-2026-66763
Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other customers' databases...
PT-2026-82490
A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as view ptables, can obtain historical template contents belonging t...
PT-2026-82423
Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager 5.0.1 - A registered user with edit-own rights the eventowner=1 setting or core.edit.own can POST another user's record id together with their own id as created by an...
CVE-2026-81817: Authorization Bypass Through User-Controlled Key
Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints. The routes generally received both a case identifier and a task identifier, but previously they did not enforce that the task actually belonged to t...
CVE-2026-81820: Improper Neutralization of Input During Web Page Generation
Affected versions of Flowintel construct timeline HTML using attacker-controllable MISP object fields such as: object UUID; object name; attribute value; attribute type; comment; first/last seen values; IDS flag. Those values were concatenated directly into HTML strings before rendering. The...
CVE-2026-78292: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Hash Form = 1.4.1 versions...
CVE-2026-78286: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Geo Controller = 8.9.8 versions...
CVE-2026-78276: Deserialization of Untrusted Data
Editor PHP Object Injection in Fluent Boards Pro = 2.0.11 versions...
CVE-2026-78257: Deserialization of Untrusted Data
Contributor PHP Object Injection in Booking and Rental Manager = 2.7.5 versions...
PT-2026-82387
The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not verify that the requesting user owns the customer profile being queried through one of its REST endpoints, allowing any authenticated user e.g. a customer/subscriber to...