CVE-2026-82814

The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.5.17 and 4.6.10, respectively, via deserialization of untrusted database content in DUPXUpdateEngine::unserializeTest during migration. This allows unauthenticate...

CVE-2026-82814 Duplicator <= 1.5.17 and Duplicator Pro <= 4.6.10 - Unauthenticated PHP Object Injection

The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.5.17 and 4.6.10, respectively, via deserialization of untrusted database content in DUPXUpdateEngine::unserializeTest during migration. This allows unauthenticate...

CVE-2026-82814

The Duplicator and Duplicator Pro plugins for WordPress (versions up to 1.5.17 and 4.6.10 , respectively) are vulnerable to unauthenticated PHP Object Injection . The root cause is the unsafe deserialization of untrusted database content in DUPX_UpdateEngine::unserializeTest() during a migration....

CVE-2026-82814 Duplicator <= 1.5.17 and Duplicator Pro <= 4.6.10 - Unauthenticated PHP Object Injection

The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.5.17 and 4.6.10, respectively, via deserialization of untrusted database content in DUPXUpdateEngine::unserializeTest during migration. This allows unauthenticate...

EUVD-2026-107032

The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.5.17 and 4.6.10, respectively, via deserialization of untrusted database content in DUPXUpdateEngine::unserializeTest during migration. This allows unauthenticate...

CVE-2026-114107

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting instructions in documents or web pages the agent processes. BashTool and BackgroundRunTool pass model-emitted commands to...

EUVD-2026-106910

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting instructions in documents or web pages the agent processes. BashTool and BackgroundRunTool pass model-emitted commands to...

MCPJam Inspector 1.4.2 Remote Command Execution

MCPJam Inspector version 1.4.2 and earlier contains a remote command execution vulnerability. The proof of concept sends a crafted server configuration to the MCP connection endpoint. https://packetstorm.news/download/236732...

PT-2026-120514

Name of the Vulnerable Software and Affected Versions OnePlus OxygenOS versions 16.1.0 through 16.1.10.499 OnePlus OxygenOS versions 16.0.0 through 16.0.5.1199 OnePlus OxygenOS versions 15.0.0 through 15.0.0.1999 Description An incorrect authorization issue exists in the olc2 logging HAL, which...

Dokploy 0.29.12 Compose Branch Command Injection

Dokploy versions 0.29.3 through 0.29.12 contain a command injection vulnerability in compose branch fields. This proof of concept demonstrates authenticated arbitrary command execution through compose deployment. https://packetstorm.news/download/236749...

Dokploy 0.29.12 Compose Branch Command Injection

Dokploy versions 0.29.3 through 0.29.12 contain a command injection in compose branch fields. The proof of concept stores a crafted branch value, triggers deployment, and confirms execution from deployment logs. https://packetstorm.news/download/236744...

Linux Distros Unpatched Vulnerability : CVE-2026-102827

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, th...

PT-2026-122473

Уязвимость системы обнаружения вторжений Snort связана с недостатками процедуры аутентификации. Эксплуатация уязвимости может позволить нарушителю выполнить произвольные команды...

VulnCheck KEV: CVE-2026-7873

IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated attackers to execute arbitrary OS commands and read sensitive files including credentials, enabling complete system compromise and lateral movement...

PT-2026-120833

Name of the Vulnerable Software and Affected Versions Pillow versions 11.0.0 through 12.x Description Multi-frame loaders in this Python imaging library can retain an ImagingCore allocation created for a narrow frame mode. When a subsequent frame of the same dimensions changes the logical mode an...

RockyLinux 10 : lrzsz (RLSA-2026:86056)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:86056 advisory. lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode CVE-2026-105840 lrzsz: lrzsz: Arbitrary command execution via...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: gdb (UTSA-2026-142302)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142302 advisory. A flaw was found in GDB's STABS debug format parser. The readmemberfunctions function in gdb/stabsread.c contains a linked list removal bug in the code that separate...

Fedora 44 : dolphin (2026-85f07f4f1b)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-85f07f4f1b advisory. - CVE-2026-110236 Arbitrary command execution via crafted folder name Tenable has extracted the preceding description block directly from the Fedora security...

Debian dla-4846 : git-lfs - security update

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dla-4846 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4846-1 [email protected] https://www.debian.org/lts/security/...

RHEL 10 : lrzsz (RHSA-2026:86056)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:86056 advisory. Lrzsz consisting of lrz and lsz is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz...