CVE-2026-73389

CVE-2026-73389 is an unauthenticated PHP Object Injection vulnerability in the Kalles Addons WordPress plugin, affecting versions 1.0.6 and earlier . The flaw allows a remote, unauthenticated attacker to achieve full compromise of confidentiality, integrity, and availability, reflected in a CVSS ...

CVE-2026-73389 WordPress Kalles Addons plugin <= 1.0.6 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Kalles Addons = 1.0.6 versions...

EUVD-2026-62390

Unauthenticated PHP Object Injection in Kalles Addons = 1.0.6 versions...

CVE-2026-73389 WordPress Kalles Addons plugin <= 1.0.6 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Kalles Addons = 1.0.6 versions...

CVE-2026-73364 WordPress Flexible Subscriptions plugin <= 1.8.1 - PHP Object Injection vulnerability

Customer PHP Object Injection in Flexible Subscriptions = 1.8.1 versions...

CVE-2026-73364

WordPress Flexible Subscriptions plugin (versions ≤ 1.8.1) is vulnerable to PHP Object Injection, allowing unauthenticated remote attackers to execute arbitrary code and achieve full system compromise (CVSS 9.8 Critical). Patchstack reference: https://patchstack.com/database/wordpress/plugin/flex...

CVE-2026-73364 WordPress Flexible Subscriptions plugin <= 1.8.1 - PHP Object Injection vulnerability

Customer PHP Object Injection in Flexible Subscriptions = 1.8.1 versions...

EUVD-2026-62384

Customer PHP Object Injection in Flexible Subscriptions = 1.8.1 versions...

WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Taylsec in WordPress Plugin FundEngine versions = 1.7.9...

WordPress Forminator plugin <= 1.57.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ahmed Hassan in WordPress Plugin Forminator versions = 1.57.0...

WordPress TaxoPress plugin <= 3.51.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by daroo in WordPress Plugin TaxoPress versions = 3.51.0...

BIT-KIBANA-2026-72681 Missing Authorization in Kibana Leading to Privilege Escalation and Information Disclosure

Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes that feature's functionality. This allows privilege escalation and could lead to disclosure of sensitive information th...

WordPress Kalles Addons plugin <= 1.0.6 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Kalles Addons versions = 1.0.6...

CVE-2026-58372

A flaw was found in SeaweedFS. An authenticated remote attacker with write access to a single bucket could exploit a path traversal vulnerability in the S3 gateway. By crafting a DeleteObjects XML request body with specific object keys containing directory traversal sequences, the attacker could...

WordPress Flexible Subscriptions plugin <= 1.8.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Van Phuc in WordPress Plugin Flexible Subscriptions versions = 1.8.1...

CVE-2026-75951: Authorization Bypass Through User-Controlled Key

Joomla Extension - cmsjunkie.com - Insecure Direct Object Reference multiple frontend/API actions in J-BusinessDirectory 6.2.3...

PT-2026-78452

Joomla Extension - cmsjunkie.com - Open mail relay in J-BusinessDirectory 6.2.3 - Recipient address was taken from the request contact id offer / contact id event instead of the server-side offer/event record, so mail could be sent to an arbitrary address...

CVE-2026-76263: Authorization Bypass Through User-Controlled Key

In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete Splunk Processing Language version 2 SPL2 modules belonging to other users through the data management orchestrator interface. The vulnerability does not affect Splunk...

PT-2026-78450

Joomla Extension - cmsjunkie.com - Insecure Direct Object Reference multiple frontend/API actions in J-BusinessDirectory 6.2.3...

CVE-2026-76325: Improper Neutralization of Input During Web Page Generation

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a malicious ui-tour knowledge object that matches an auto-tour page name and share the object at the app level. The object can execute arbitrary JavaScript in the browser o...