CVE-2026-49400 October CMS: PHP Object Injection via Backend Widget Session Storage

October System provides the system module for October Content Management System. Prior to versions 3.7.17 and 4.2.21, the backend SessionMaker trait stored widget session state as base64serialize... and consumed it with unserialize without an allowedclasses restriction. Any code path that could...

CVE-2026-49400

October CMS (System module) prior to v3.7.17 and v4.2.21 is affected by a PHP object injection vulnerability in the backend SessionMaker trait, which stored widget session state as base64(serialize(...)) and deserialized it with unserialize() without an allowed_classes restriction. Exploitation r...

October CMS: PHP Object Injection via Backend Widget Session Storage

The backend SessionMaker trait stored widget session state as base64serialize... and consumed it with unserialize without an allowedclasses restriction. Any code path that could write to a widget. session key with attacker-controlled bytes could trigger PHP object injection the next time the widg...

GHSA-2FF2-MX52-Q8WP October CMS: PHP Object Injection via Backend Widget Session Storage

The backend SessionMaker trait stored widget session state as base64serialize... and consumed it with unserialize without an allowedclasses restriction. Any code path that could write to a widget. session key with attacker-controlled bytes could trigger PHP object injection the next time the widg...

Wordfence Argus Identifies Two Critical Unauthenticated Vulnerability Chains Leading to Remote Code Execution in The Events Calendar Plugin

On August 21 and August 22, 2026, Wordfence Argus, created by the Wordfence Threat Intelligence team, identified two independent critical vulnerability chains in The Events Calendar, a WordPress plugin active on more than 600,000 websites. Both chains begin in the plugin's widget-rendering pipeli...

CVE-2026-55072 Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name

Pimcore is an Open Source Data & Experience Management Platform. Prior to 2026.1.5, an authenticated user with the objects permission can submit a malicious ClassDefinition UID because the name and ID validation expressions in models/DataObject/ClassDefinition.php validate only the beginning of...

CVE-2026-61534

Yayson is a library for serializing and reading JSON API data in JavaScript. Prior to 4.3.0, Store and LegacyStore use attacker-controlled JSON:API type, id, and relationship names as keys in plain-object lookup tables in src/yayson/store.ts and src/yayson/legacy-store.ts. A document whose type i...

CVE-2026-61701

Laravel MagicLink (versions 2.0.0 through 2.25.1) is vulnerable to insecure deserialization of serialized action objects stored in the magic_links.action database column. The deserialization path in src/MagicLink.php and src/Actions/ResponseAction.php relies on an unsafe legacy unserialize() fall...

CVE-2026-61534 Yayson: Prototype pollution in the Store/LegacyStore deserialization

Yayson is a library for serializing and reading JSON API data in JavaScript. Prior to 4.3.0, Store and LegacyStore use attacker-controlled JSON:API type, id, and relationship names as keys in plain-object lookup tables in src/yayson/store.ts and src/yayson/legacy-store.ts. A document whose type i...

CVE-2026-90771

A flaw was found in joi. This vulnerability, known as prototype pollution, exists in the messages compilation function. A remote attacker can exploit this by supplying specially crafted proto keys in custom messages. This allows the attacker to manipulate object properties, which could lead to...

Astra Linux – Vulnerability in Wireshark

In Wireshark versions 3.0.0 to 3.0.6, and 2.6.0 to 2.6.12, the CMS dissector could crash. This issue was addressed in the epan/dissectors/asn1/cms/packet-cms-template.c file by ensuring that an object identifier is set to NULL after the ContentInfo dissection...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: sched/taskstack: fixed the objectisonstack function for KASAN-tagged pointers When CONFIGKASANSWTAGS and CONFIGKASANSTACK are enabled, the objectisonstack function may produce incorrect results due to the presence of tags in the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: binder: A check for offset alignment was added in bindergetobject. Commit 6d98eb95b450 “binder: avoid potential data leakage when copying txn” introduced changes to the way binder objects are copied. As a result, the offset...

Astra Linux – Vulnerability in libjettison-java

A stack overflow in Jettison prior to v1.5.2 allowed attackers to cause a Denial of Service DoS attack through crafted JSON data...

Astra Linux – Vulnerability in opensc

OpenSC before version 0.20.0 has a double-free issue in coolkeyfreeprivatedata, because the coolkeyaddobject function in libopensc/card-coolkey.c lacks a uniqueness check...

Astra Linux – Vulnerability in Thunderbird

If a Thunderbird user quoted an HTML email, for example by replying to that email, and the email contained a VIDEO tag with the POSTER attribute or an OBJECT tag with a DATA attribute, a network request to the referenced remote URL would be made, regardless of any configuration that blocks remote...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: lib: objagg: Fixed general protection fault The library supports the aggregation of objects into other objects only if the parent object does not have a parent itself. In other words, nesting is not supported. Aggregation occurs ...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: phonet/pep: refusal to enable an unbound pipe The ioctl function implicitly assumed that the socket was already bound to a valid local socket name, i.e., a Phonet object. If the socket was not bound, two problems would occur: 1 W...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel before version 6.0.3, the file drivers/gpu/drm/virtio/virtgpuobject.c misinterprets the return value of drmgemshmemgetsgtable. It expects the value to be NULL in the error case, but in reality, it is an error pointer...

Astra Linux – Vulnerability in Firefox and Thunderbird

During process shutdown, a document could cause a use-after-free of a languages service object, resulting in memory corruption and potentially exploitable crashes. This vulnerability affects Firefox 93, Thunderbird 91.2, and Firefox ESR 91.2...