44305 matches found
CVE-2026-71191
A flaw was found in the S3API middleware of OpenStack Swift. The SigV4 presigned URL implementation does not require that semantic x-amz- headers be included in the request signature. An attacker who obtains a presigned PUT URL can inject unsigned headers such as X-Amz-Copy-Source to copy objects...
CVE-2026-64640 Apache Polaris: register endpoint reads attacker-controlled storage location before allowed-locations validation
Apache Polaris did not consistently validate storage locations supplied during table and view registration. An authenticated principal with permission to register a table or view could, depending on the affected release and registration path, cause Polaris to use the catalog's storage credentials...
WordPress ChamaWP plugin < 1.0.13 - Unauthenticated PHP Object Injection vulnerability
Unauthenticated PHP Object Injection vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin ChamaWP versions 1.0.13...
CVE-2026-14313 PeproDev WooCommerce Receipt Uploader <= 2.8.0 - Unauthenticated Order Receipt Tampering via IDOR
PeproDev WooCommerce Receipt Uploader PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 slug: pepro-bacs-receipt-upload-for-woocommerce, all versions up to and including 2.8.0 latest on wordpress.org; no fixed version available at the time of writing, is vulnerable to...
CVE-2026-14314 PeproDev WooCommerce Receipt Uploader <= 2.8.0 - Unauthenticated Image Attachment Disclosure via IDOR
The PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 does not verify that a requested attachment belongs to the order referenced by its access token, allowing unauthenticated attackers to forge a token and disclose image attachments, including other customers' uploaded payment...
CVE-2026-14313
PeproDev WooCommerce Receipt Uploader PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 slug: pepro-bacs-receipt-upload-for-woocommerce, all versions up to and including 2.8.0 latest on wordpress.org; no fixed version available at the time of writing, is vulnerable to...
CVE-2026-14313 PeproDev WooCommerce Receipt Uploader <= 2.8.0 - Unauthenticated Order Receipt Tampering via IDOR
PeproDev WooCommerce Receipt Uploader PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 slug: pepro-bacs-receipt-upload-for-woocommerce, all versions up to and including 2.8.0 latest on wordpress.org; no fixed version available at the time of writing, is vulnerable to...
CVE-2026-14314
The PeproDev WooCommerce Receipt Uploader WordPress plugin (versions
CVE-2026-67863
A flaw was found in open62541. A server-side use-after-free vulnerability exists in the local MonitoredItem callback path. This occurs when the system attempts to use a notification object after it has been deallocated. A remote attacker can exploit this vulnerability to cause a denial of service...
SUSE CVE-2026-67316
axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases axios.get, axios.delete, axios.head, axios.options, inherited data is read via...
PT-2026-68565
Name of the Vulnerable Software and Affected Versions Adrena versions prior to 1.2.15 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of gadget...
PT-2026-68566
Name of the Vulnerable Software and Affected Versions Advice versions prior to 1.18.1 Description The Advice - Psychology, Therapy & Counseling Theme for WordPress allows unauthenticated attackers to perform PHP Object Injection through the deserialization of untrusted input. PHP Object Injection...
CVE-2026-67622: Authorization Bypass Through User-Controlled Key
Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID to Assistants endpoints without workspace ownersh...
CVE-2026-65572: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in A.Williams = 1.3.1 versions...
PT-2026-68561
Name of the Vulnerable Software and Affected Versions A.Williams versions prior to 1.3.2 Description The A.Williams plugin for WordPress allows unauthenticated attackers to perform PHP Object Injection through the deserialization of untrusted input. This issue occurs when the application processe...
PT-2026-68563
Name of the Vulnerable Software and Affected Versions Abogado versions prior to 1.19 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP Object. While no POP chain a sequence of gadgets used t...
CVE-2026-65577: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Advice = 1.18.0 versions...
PT-2026-68569
Name of the Vulnerable Software and Affected Versions AI ANN versions prior to 1.29.1 Description The AI ANN - AI Generator & AI Agency WordPress Theme is subject to PHP Object Injection due to the deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP Object...