WordPress Reycob Product Import Export plugin <= 2.3.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Reycob Product Import Export versions = 2.3.0...

EUVD-2026-85262

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Privilege Escalation vulnerability that allowed an authenticated low-privilege user to gain Administrator privileges through Report Profile import...

CVE-2026-84787

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below are vulnerable to a Privilege Escalation vulnerability. An authenticated low-privilege user can gain Administrator privileges by exploiting the Report Profile import functionality. The vulnerability carries a base s...

CVE-2026-84787 Privilege Escalation vulnerability

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Privilege Escalation vulnerability that allowed an authenticated low-privilege user to gain Administrator privileges through Report Profile import...

CVE-2026-84787 Privilege Escalation vulnerability

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Privilege Escalation vulnerability that allowed an authenticated low-privilege user to gain Administrator privileges through Report Profile import...

CVE-2026-91024

The Booking Manager WordPress plugin (versions before 2.1.21 ) is vulnerable to SQL injection due to improper neutralization of special elements. The root cause is the failure to sanitize and escape values retrieved from a fetched external iCalendar feed before incorporating them into a SQL query...

CVE-2026-91024 Booking Manager < 2.1.21 - Author+ SQLi via ICS Import Feed UID (sync_gid)

The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query, allowing authenticated users with Author-level access and above to perform SQL injection attacks by importing a feed they control...

SUSE CVE-2026-63273

LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted document. The length of the decryption key was taken from the document's own encryption dictionary and was used to fill a fixed size key buffer without being checked against it, so a length large...

SUSE CVE-2026-63274

LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken from the object's own dictionary and was not checked against the number of bytes actually present, so copying the stream read and wrote past the end of the...

Penpot 2.17.2 Arbitrary File Overwrite

Penpot versions 1.20 through 2.17.2 contain a missing authorization vulnerability in the file import RPC command. An authenticated attacker can supply the identifier of another user's file to overwrite its contents and re-parent the file into an attacker-controlled project, resulting in file...

Linux Distros Unpatched Vulnerability : CVE-2026-63273

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted document. The length of the decryption key was taken from...

CVE-2026-91775: Improper Neutralization of Input During Web Page Generation

LimeSurvey Community Edition 7.0.14 fails to safely encode attacker-controlled content from a crafted .lss survey file when displaying import warnings, resulting in XSS in the administrative interface...

PT-2026-97304

Name of the Vulnerable Software and Affected Versions ManageEngine OpManager versions prior to 12.8.711 ManageEngine Firewall Analyzer versions prior to 12.8.711 Description An authenticated low-privilege user can gain Administrator privileges through the Report Profile import feature. This issue...

Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-2026-164

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module includes a Webform Submission Export/Import submodule that allows importing submission data from uploaded CSV files or remote URLs. The submodule did not...

CVE-2026-86583: Incorrect Privilege Assignment

The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.4.17 via the plugin's own export and re-import workflow. The vulnerability exists because the exporter writes CSV cells using fputcsv with a NUL byte \0 as...

PT-2026-97491

Shop manager PHP Object Injection in Reycob Product Import Export = 2.3.0 versions...

CVE-2026-84787: Execution with Unnecessary Privileges

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Privilege Escalation vulnerability that allowed an authenticated low-privilege user to gain Administrator privileges through Report Profile import...

CVE-2026-95603: Deserialization of Untrusted Data

Shop manager PHP Object Injection in Reycob Product Import Export = 2.3.0 versions...

PT-2026-97442

Name of the Vulnerable Software and Affected Versions LimeSurvey Community Edition version 7.0.14 Description A reflected cross-site scripting issue exists on the administrative survey-participant CSV import result page. Reflected cross-site scripting occurs when an application includes untrusted...

PT-2026-97662

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module includes a Webform Submission Export/Import submodule that allows importing submission data from uploaded CSV files or remote URLs. The submodule did not...