40536 matches found
CVE-2026-16258 Ajax Search Lite < 4.14.5 - Unauthenticated PHP Object Injection via Search Statistics REST Endpoint
The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed Ajax Search Lite WordPress plugin before 4.14.5 or , this can...
CVE-2026-16258
The Ajax Search Lite WordPress plugin (versions before 4.14.5 ) is vulnerable to PHP Object Injection due to the insecure deserialization of untrusted input. This flaw is specifically located in the Search Statistics REST Endpoint . An unauthenticated attacker can exploit this to achieve Remote C...
OESA-2026-3254 python3 security update
Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C...
PT-2026-68888
Name of the Vulnerable Software and Affected Versions LUCID Vision Labs Arena SDK version 1.0.80.49 Description DLL Search Order Hijacking on Windows allows a local attacker to execute arbitrary code with the privileges of the application. This occurs when the SDK traverses directories listed in...
PT-2026-68870
Name of the Vulnerable Software and Affected Versions Ajax Search Lite versions prior to 4.14.5 Description An issue exists where the software fails to prevent the deserialization of untrusted input, enabling unauthenticated attackers to perform PHP Object Injection. This occurs via the Search...
PT-2026-69140
Name of the Vulnerable Software and Affected Versions Pathling Server versions prior to 2.0.0 Description Pathling Server contains an authorization bypass in its typed CRUD, search, and batch FHIR surface. Authenticated users with coarse operation authorities can interact with resource families...
CVE-2026-16258: Deserialization of Untrusted Data
The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed Ajax Search Lite WordPress plugin before 4.14.5 or , this can...
CVE-2026-9169: Uncontrolled Search Path Element
DLL Search Order Hijacking in LUCID Vision Labs Arena SDK 1.0.80.49 on Windows allows a local attacker to execute arbitrary code with the privileges of the application by placing a malicious DLL in a user-controlled directory listed in the PATH environment variable, which the SDK traverses when a...
Amazon Kiro IDE 1.0.x < 1.0.228 Uncontrolled Search Path Element (Windows)
The version of Amazon Kiro IDE installed on the remote Windows host is 1.0.x prior to 1.0.228. It is, therefore, affected by a vulnerability. - An uncontrolled search path element in Kiro IDE before version 1.0.228 on Windows might allow a remote unauthenticated actor to execute arbitrary code vi...
PT-2026-69133
Name of the Vulnerable Software and Affected Versions Pathling Server versions prior to 2.0.0 Description Pathling Server contains an authorization bypass in its typed CRUD, search, and batch FHIR surface. Authenticated users with coarse operation authorities can interact with resource families...
CVE-2026-19046
A security vulnerability has been detected in NocteDefensor LudusMCP up to 1.0.24. The impacted element is an unknown function of the file src/tools/ludusEnvironmentGuidesSearch.ts of the component ludusenvironmentguidessearch. Such manipulation of the argument guidename leads to path traversal...
CVE-2026-28139
Unauthenticated PHP Object Injection in Ajax Search Lite = 4.14.4 versions...
CVE-2026-19046 NocteDefensor LudusMCP ludus_environment_guides_search ludusEnvironmentGuidesSearch.ts path traversal
A security vulnerability has been detected in NocteDefensor LudusMCP up to 1.0.24. The impacted element is an unknown function of the file src/tools/ludusEnvironmentGuidesSearch.ts of the component ludusenvironmentguidessearch. Such manipulation of the argument guidename leads to path traversal...
EUVD-2026-54079
A security vulnerability has been detected in NocteDefensor LudusMCP up to 1.0.24. The impacted element is an unknown function of the file src/tools/ludusEnvironmentGuidesSearch.ts of the component ludusenvironmentguidessearch. Such manipulation of the argument guidename leads to path traversal...
CVE-2026-19046
CVE-2026-19046 affects NocteDefensor LudusMCP (up to 1.0.24). The vulnerable element is an unknown function in src/tools/ludusEnvironmentGuidesSearch.ts of the ludus_environment_guides_search component. According to the description, manipulating the guide_name argument enables path traversal, wit...
EUVD-2026-53951
Shop manager Cross Site Scripting XSS in FiboSearch = 1.33.0 versions...
CVE-2026-28139 WordPress Ajax Search Lite plugin <= 4.14.4 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Ajax Search Lite = 4.14.4 versions...
EUVD-2026-53942
Unauthenticated PHP Object Injection in Ajax Search Lite = 4.14.4 versions...
CVE-2026-28139
CVE-2026-28139 concerns the WordPress plugin Ajax Search Lite (vulnerable: ≤ 4.14.4). The issue is an unauthenticated PHP Object Injection in the plugin’s handling of objects, as described in CVE details and corroborated by multiple feeds. Affected component: the Ajax Search Lite plugin; root cau...