CVE-2026-19116

The User Frontend WordPress plugin before version 4.3.11 is vulnerable to PHP Object Injection because it fails to prevent the deserialization of user-supplied field values. This occurs when a submitted post is reopened within its frontend editing form. Attackers with subscriber-level access or h...

EUVD-2026-69865

The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing authenticated users with subscriber-level access and above to perform PHP Object Injection, which may lead ...

CVE-2026-19116 WP User Frontend < 4.3.11 - Subscriber+ PHP Object Injection via Frontend Post Edit Form

The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing authenticated users with subscriber-level access and above to perform PHP Object Injection, which may lead ...

CVE-2026-19116 WP User Frontend < 4.3.11 - Subscriber+ PHP Object Injection via Frontend Post Edit Form

The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing authenticated users with subscriber-level access and above to perform PHP Object Injection, which may lead ...

EUVD-2026-69869

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token before running the post-booking action chain, allowing an unauthenticated user to trigger booking notifications and integration callbacks for a booking by...

Security Bulletin: Vulnerabilities exists in IBM Cloud Pak for Data System (CPDS 1.0)

Summary Vulnerabilities exists in IBM Cloud Pak for Data System CPDS 1.0 addressed in 11.3.1.2-IF1 Vulnerability Details CVEID:CVE-2026-14350 DESCRIPTION: The product could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written ...

CVE-2026-19754 Baserow 2.2.0 through 2.3.3 - SQL injection in formula index() JSONB array extraction

Baserow versions 2.2.0 through 2.3.3 contain an SQL injection vulnerability in the index formula function. A low-privileged authenticated user who can create or modify Formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a...

CVE-2026-19754

CVE-2026-19754 is a SQL injection vulnerability in Baserow 2.3.3 , specifically in the index() formula function (used for JSONB array extraction). A low-privileged authenticated user who can create or modify formula fields can supply an undocumented fourth argument that is treated as a SQL templa...

CVE-2026-19754 Baserow 2.2.0 through 2.3.3 - SQL injection in formula index() JSONB array extraction

Baserow versions 2.2.0 through 2.3.3 contain an SQL injection vulnerability in the index formula function. A low-privileged authenticated user who can create or modify Formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a...

CVE-2026-19754 Baserow 2.2.0 through 2.3.3 - SQL injection in formula index() JSONB array extraction

Baserow versions 2.2.0 through 2.3.3 contain an SQL injection vulnerability in the index formula function. A low-privileged authenticated user who can create or modify Formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a...

[SECURITY] Fedora 43 Update: bubblewrap-0.12.0-1.fc43

Bubblewrap /usr/bin/bwrap is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces...

SUSE CVE-2026-5078

Impact: The morgan logging middleware's :remote-user token extracts the Basic auth username from the Authorization request header and writes it to the log stream without neutralizing control characters. An unauthenticated attacker can send a crafted Authorization Basic header containing CR or LF...

Security Bulletin: IBM QRadar SIEM could allow an authenticated user to obtain sensitive information from backup files due to incorrect permissions assignment.

Summary IBM QRadar SIEM could allow an authenticated user to obtain sensitive information from backup files due to incorrect permissions assignment. Vulnerability Details CVEID:CVE-2025-33141 DESCRIPTION: IBM QRadar SIEM could allow an authenticated user to obtain sensitive information from backu...

EUVD-2026-69721

WWBN AVideo current e01e41ecc and earlier makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder/isAVideoMobileApp checks match HTTPUSERAGENT against a hardcoded literal "AVideoEncoder"/"AVideoMobileApp" with no IP check or shared...

EUVD-2026-69715

A time-of-check time-of-use race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution. Exploitation required an authenticated user with write access to a repository and precise timing of concurrent upload requests. This vulnerability affected all...

PT-2026-84609

The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing authenticated users with subscriber-level access and above to perform PHP Object Injection, which may lead ...

PT-2026-84830

Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0.10.0, BorutaIdentityWeb.UserSettingsController.update/2 atomizes every key of the user-supplied request body via String.to atom/1 before...

CVE-2026-17563: Missing Authorization

The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submissions, only when rendering the form, allowing unauthenticated users to create and, depending on the form's configuration, immediately publish posts through...

PT-2026-84802

Name of the Vulnerable Software and Affected Versions rpmuncompress affected versions not specified Description A command injection flaw exists in rpmuncompress that allows a local attacker to execute arbitrary commands. The issue occurs when the tool processes a specially crafted archive filenam...

PT-2026-84748

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description Incorrect Authorization in the machine learning feature allows an authenticated user to invoke functionality beyond their authorized scope. This can lead to unauthorized resource consumption o...