mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"

Impact Prior to version 0.6.0, mchange-commons-java includes a JNDI ObjectFactory implementation com.mchange.v2.naming.JavaBeanObjectFactory willing to construct objects of arbitrary classes and initialize "JavaBean"-style properties. There are classes for which this kind of initialization is...

EUVD-2026-41135

mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"...

GHSA-H84G-69H7-MW6V mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"

Impact Prior to version 0.6.0, mchange-commons-java includes a JNDI ObjectFactory implementation com.mchange.v2.naming.JavaBeanObjectFactory willing to construct objects of arbitrary classes and initialize "JavaBean"-style properties. There are classes for which this kind of initialization is...

CVE-2026-12366

Zephyr's dynamic kernel-object disposal path unrefcheck in kernel/userspace/userspace.c frees an object's storage kfreedyn-data once its reference count reaches zero, after running a per-object-type cleanup. The cleanup switch handled only KOBJMSGQ and KOBJSTACK; there was no KOBJTIMER case. A...

CVE-2026-12366

Summary: CVE-2026-12366 in Zephyr describes a use-after-free in the dynamic object disposal path for kernels objects. When a user-thread holds the last permission on a timer (K_OBJ_TIMER) and frees it, the timer’s memory is released without cancelling its embedded _timeout node from the global _t...

CVE-2026-12366 Use-after-free freeing an armed dynamically-allocated k_timer in Zephyr userspace object disposal

Zephyr's dynamic kernel-object disposal path unrefcheck in kernel/userspace/userspace.c frees an object's storage kfreedyn-data once its reference count reaches zero, after running a per-object-type cleanup. The cleanup switch handled only KOBJMSGQ and KOBJSTACK; there was no KOBJTIMER case. A...

SUSE CVE-2026-68262

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix user array stride in pvrsetuobjarray pvrsetuobjarray copies an array of kernel objects to a userspace array whose element size is described by out-stride. When out-stride is different from the kernel object...

Exploit for CVE-2026-54356

CVE-2026-54356 — Budibase: authenticated arbitrary S3 signed u...

CVE-2026-19870

The CVE-2026-19870 entry concerns Roskus Prospero Flow CRM (vendor Roskus) prior to version 5.15.10. It is an IDOR in the payroll module where authenticated users with read payroll permission can view salary and banking details of employees from other companies, and users with create payroll perm...

WordPress Essential Real Estate plugin <= 5.3.3 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Steven Julian in WordPress Plugin Essential Real Estate versions = 5.3.3...

WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by daroo in WordPress Plugin FundEngine versions = 1.7.9...

GO-2026-5662 vulnerabilities

Vulnerabilities for packages: istio, prometheus-pushgateway, karma, jaeger, aws-otel-collector, keda, minio-object-browser, cloud-sql-proxy, datadog-agent, loki, tempo, minio-operator, certificate-transparency, mc, mcp-grafana, minio, telegraf, grafana-pyroscope, trillian, splunk-otel-collector...

WordPress WooCommerce Subscriptions plugin < 9.1.0 - Unauthenticated RCE via PHP Object Injection vulnerability

Unauthenticated RCE via PHP Object Injection vulnerability discovered by Vasily Belolapotkov, Vlad Olaru in WordPress Plugin WooCommerce Subscriptions versions 9.1.0...

WordPress WP Crowdfunding plugin < 2.2.1 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Jakub Herman in WordPress Plugin WP Crowdfunding versions 2.2.1...

EUVD-2026-58501

Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to upload files with traversal sequences that are preserved during export. Attackers can craft filenames containing .. segments that escape the temporary directory during workspace export, writing...

CVE-2026-48528: Improper Neutralization of Special Elements used in an SQL Command

Metacat is data repository software that helps researchers preserve, share, and discover data. Metacat versions 2.0.0 through 3.4.0 contain an unauthenticated SQL injection vulnerability in the /cn/v1/object and /cn/v2/object REST API endpoints due to unsanitized user input that can be passed...

...[ More ]

A proof of concept exploit for an unauthenticated PHP object injection vulnerability in WooCommerce Subscriptions versions prior to 9.1.0 when High-Performance Order Storage is enabled. Attacker-controlled data supplied through the User-Agent header can undergo unsafe deserialization during...

CVE-2026-73659

Trigger.dev is the open-source platform for building AI workflows in TypeScript. From 4.4.2 until 4.5.0, the packet presign routes in apps/webapp/app/routes/api.v1.packets.$.ts pass a caller-controlled filename through resolveStoreProtocolForPacketPresign to generatePresignedUrl and...

CVE-2026-73421

NextAuth.js provides authentication for Next.js. From next-auth 5.0.0-beta.0 until 5.0.0-beta.32, applications that gate access by checking only for the existence of the auth object returned by the auth wrapper can fail open when Auth.js has a server configuration error. In middleware, Route...

CVE-2026-73039

streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated users to read and delete other users' viewing status records. Attackers can enumerate all users' watch progress, delete arbitrary viewing history, and manipulate other users'...