45028 matches found
WordPress Blocksy Companion Pro plugin <= 2.1.46 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by Austin Ginder in WordPress Plugin Blocksy Companion Pro versions = 2.1.46...
CVE-2026-52970
A flaw was found in the netfilter: nftct component of the Linux kernel. The nftctexpectobjeval function allocates an expectation but fails to release its local reference. This oversight leads to a resource leak, which could potentially allow a local attacker to cause a denial of service by...
SUSE CVE-2026-52951
In the Linux kernel, the following vulnerability has been resolved: drm/xe/dma-buf: handle empty bo and UAF races There look to be some nasty races here when triggering the invalidatemappings hook: 1 We do xeboalloc followed by the attach, before the actual full bo init step in xedmabufinitobj...
PT-2026-52888
Name of the Vulnerable Software and Affected Versions Envoy versions prior to 1.35.11 Envoy versions prior to 1.36.7 Envoy versions prior to 1.37.3 Envoy versions prior to 1.38.1 Description A stack overflow occurs during the destructor process of a JSON Object when deeply nested objects, reachin...
PT-2026-52794
Zed Attack Proxy ZAP ViewState add-on before version 4 contains an insecure deserialization vulnerability that allows attackers who control a proxied web server to achieve arbitrary code execution by embedding a malicious serialized Java object in the javax.faces.ViewState HTTP response parameter...
PT-2026-52801
Name of the Vulnerable Software and Affected Versions Blocksy Companion Pro versions prior to 2.1.47 Description An Insecure Direct Object Reference IDOR exists due to missing validation on a user-controlled key. This allows unauthenticated attackers to perform unauthorized actions. IDOR is a typ...
CVE-2026-48042: Excessively Deep Nesting
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, destructor of JSON Object results in stack overflow when deeply O100K nested objects are present. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1...
CVE-2026-56055: Deserialization of Untrusted Data
Subscriber PHP Object Injection in RealHomes = 4.5.3 versions...
CVE-2026-54834: Insertion of Sensitive Information Into Sent Data
Unauthenticated Sensitive Data Exposure in Object Cache 4 everyone = 2.3.2 versions...
CVE-2026-56031: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Uncanny Automator = 7.3.1.2 versions...
PT-2026-52747
Unauthenticated PHP Object Injection in Uncanny Automator = 7.3.1.2 versions...
PT-2026-53025
Name of the Vulnerable Software and Affected Versions js-toml versions prior to 1.1.2 Description The interpreter incorrectly verifies if a key already exists in a parser-built container by using if objectkey instead of if key in object. When a key is assigned a falsy primitive value—such as fals...
PT-2026-52816
Subscriber Insecure Direct Object References IDOR in Majestic Support = 1.1.7 versions...
PT-2026-52714
Name of the Vulnerable Software and Affected Versions BookPro versions prior to 1.1.1 Description An unauthenticated Insecure Direct Object Reference IDOR exists, which occurs when an application provides direct access to objects based on user-supplied input without sufficient authorization check...
CVE-2026-56057: Deserialization of Untrusted Data
Subscriber PHP Object Injection in Uncanny Automator Pro = 7.3.0.6 versions...
PT-2026-52764
Subscriber PHP Object Injection in Uncanny Automator Pro = 7.3.0.6 versions...
CVE-2026-56032: Deserialization of Untrusted Data
Subscriber PHP Object Injection in Buddyboss Platform = 3.0.4 versions...
PT-2026-52969
An issue in the DSO::mmap and copy function of relibc commit 61f42d allows attackers to cause a Denial of Service DoS via loading a crafted shared library...