Exploit for Improperly Controlled Sequential Memory Allocation in Php

php2shell-exp Profile-driven php2shell chain CVE-2026-109619...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php2shell — pre-auth RCE in PHP session upload-progress Eng...

CVE-2026-96378

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Commerce Decoupled Checkout allows Object Injection. This issue affects Commerce Decoupled Checkout versions: from 1.0.0 to 1.8.0...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

cve-id Donate Help maintain this project...

EUVD-2026-107822

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Commerce Decoupled Checkout allows Object Injection. This issue affects Commerce Decoupled Checkout versions: from 1.0.0 to 1.8.0...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

This script performs only a small number of ordinary GET request...

CVE-2026-112868 WordPress H5P plugin <= 1.17.9 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in H5P H5P h5p allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects H5P: from n/a through 1.17.9...

CVE-2026-112868

The WordPress H5P plugin (versions

DRUPAL-CONTRIB-2026-230

This module provides a user interface to select and configure icons, including a CKEditor 5 button and widget that embed an icon in formatted text. Under uncommon situations, the CKEditor 5 widget displays admin-controlled text with appropriate filtering leading to a Cross-site scripting XSS...

PT-2026-120907

This module provides a user interface to select and configure icons, including a CKEditor 5 button and widget that embed an icon in formatted text. Under uncommon situations, the CKEditor 5 widget displays admin-controlled text with appropriate filtering leading to a Cross-site scripting XSS...

CLSA-2026-1777890711 flatpak: Fix of 2 CVEs

CVE-2026-34079: fix arbitrary host file deletion via app-controlled ld.so cache symlink in flatpakswitchsymlinkandremove...

CVE-2026-112861

Authorization Bypass Through User-Controlled Key vulnerability in xnau webdesign Participants Database participants-database allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Participants Database: from n/a through 2.7.8.5...

CVE-2026-112861 WordPress Participants Database plugin <= 2.7.8.5 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in xnau webdesign Participants Database participants-database allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Participants Database: from n/a through 2.7.8.5...

CVE-2026-112861

The Participants Database plugin for WordPress (versions up to 2.7.8.5 ) is vulnerable to an Insecure Direct Object Reference (IDOR) . This vulnerability is caused by an Authorization Bypass Through User-Controlled Key , where incorrectly configured access control security levels allow for unauth...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-31637)

In the Linux kernel, the following vulnerability has been resolved: rxrpc: reject undecryptable rxkad response tickets rxkaddecryptticket decrypts the RXKAD response ticket and then parses the buffer as plaintext without checking whether cryptoskcipherdecrypt succeeded. A malformed RESPONSE can...

EUVD-2026-104326

Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.1...

CVE-2026-110901

Authorization Bypass Through User-Controlled Key vulnerability in WPMU DEV SmartCrawl smartcrawl-seo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SmartCrawl: from n/a through 3.16.4...

EUVD-2026-102862

Authorization Bypass Through User-Controlled Key vulnerability in WPMU DEV SmartCrawl smartcrawl-seo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SmartCrawl: from n/a through 3.16.4...

EUVD-2026-102827

Authorization bypass through User-Controlled key vulnerability in SFM Software Technologies Inc. Costifier allows Exploitation of Trusted Identifiers. This issue affects Costifier: through 2026-10-16. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...

CVE-2026-97858: Improperly Controlled Modification of Dynamically-Determined Object Attributes

An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the device's full serial ID...