Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: fs: Relaxing the assertions when encoding file handles fails Encoding file handles is typically performed by a filesystem method called encodefh, which may fail for various reasons. Legacy users of exportfsencodefh—specifically,...

Astra Linux – Vulnerability in Zabbix

When exporting media types, the passwords are exported in plain text within the YAML file. This appears to be a best practices issue and may not actually have any significant impact. The user must have permissions to access the media types, and therefore it is expected that they will have access ...

Astra Linux – Vulnerability in Git

Git is a distributed revision control system. git log can display commits in an arbitrary format using its --format specifiers. This functionality is also exposed to git archive via the export-subst gitattribute. When processing the padding operators, there is an integer overflow in...

CVE-2026-47168

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can supply crafted serialized PHP object data that is stored in background MassAction or Export parameters and later deserialized by the application. The deserialization paths do...

CVE-2026-47168

The open-source CRM application EspoCRM is vulnerable to Remote Code Execution (RCE) in versions prior to 9.3.7 . An authenticated administrator can exploit unsafe PHP object deserialization by supplying crafted serialized data within MassAction or Export parameters . Because the application fail...

CVE-2026-47168 EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export params

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can supply crafted serialized PHP object data that is stored in background MassAction or Export parameters and later deserialized by the application. The deserialization paths do...

CVE-2026-47168 EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export params

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can supply crafted serialized PHP object data that is stored in background MassAction or Export parameters and later deserialized by the application. The deserialization paths do...

EUVD-2026-102096

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can supply crafted serialized PHP object data that is stored in background MassAction or Export parameters and later deserialized by the application. The deserialization paths do...

CVE-2026-17001

The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Column User Meta Profile Fields in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-17001

The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.4.5 . The root cause is insufficient input sanitization and output escaping within the Custom Column User Meta Profile Fields . This allows authe...

CVE-2026-17001 Import and export users and customers <= 2.4.5 - Authenticated (Custom+) Stored Cross-Site Scripting via User Meta Profile Fields

The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Column User Meta Profile Fields in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

EUVD-2026-101840

The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Column User Meta Profile Fields in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-47168: Deserialization of Untrusted Data

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can supply crafted serialized PHP object data that is stored in background MassAction or Export parameters and later deserialized by the application. The deserialization paths do...

CVE-2026-17001: Improper Neutralization of Input During Web Page Generation

The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Column User Meta Profile Fields in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

PT-2026-114957

Name of the Vulnerable Software and Affected Versions EspoCRM versions prior to 9.3.7 Description An authenticated administrator can provide crafted serialized PHP object data stored in background MassAction or Export parameters. The application later deserializes this data without restricting...

WordPress Import and Export Users and Customers 2.4.5 Cross Site Scripting

WordPress Import and Export Users and Customers plugin versions through 2.4.5 contain an authenticated stored cross site scripting vulnerability through custom column user meta profile fields...

CVE-2026-96540

An improper access control vulnerability has been identified in the SonicWall Network Security Manager NSM on-prem in export settings, potentially allowing a remote authenticated attacker to obtain sensitive information. This may allow the attacker to escalate privileges to an administrator or to...

EUVD-2026-101629

An improper access control vulnerability has been identified in the SonicWall Network Security Manager NSM on-prem in export settings, potentially allowing a remote authenticated attacker to obtain sensitive information. This may allow the attacker to escalate privileges to an administrator or to...

CVE-2026-96540

An improper access control vulnerability (CWE-863) exists in the SonicWall Network Security Manager (NSM) on-prem within the export settings. A remote authenticated attacker could exploit this flaw to obtain sensitive information , potentially leading to privilege escalation to administrator stat...

WordPress Import and export users and customers plugin <= 2.4.5 - Authenticated (Custom+) Stored Cross-Site Scripting vulnerability

Authenticated Custom+ Stored Cross-Site Scripting vulnerability discovered by Luca Laytynher LyT in WordPress Plugin Import and export users and customers versions = 2.4.5...