GHSA-GGR8-5VV4-36MX DeepmergeTS has stack exhaustion when merging recursive object graphs

Summary deepmerge and deepmergeInto can be crashed with a crafted recursive object graph. When both merged values contain self-references at the same property path, the library recurses until Node throws RangeError: Maximum call stack size exceeded. Details Record merging is implemented...

Uncontrolled Recursion

Overview deepmerge-ts is a Deeply merge 2 or more objects respecting type information. Affected versions of this package are vulnerable to Uncontrolled Recursion via the deepmerge and deepmergeInto functions. An attacker can cause a process crash or denial of service by supplying crafted recursiv...

EUVD-2026-60116

opensslencrypt versions before 1.4.0 contain a sandbox escape vulnerability in IsolatedPluginExecutor that exposes Python type objects in restricted exec builtins. Attackers can traverse the Python class hierarchy via class.mro.subclasses to access system functions and execute arbitrary OS comman...

WordPress Object Sync for Salesforce plugin <= 2.2.13 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by nthng in WordPress Plugin Object Sync for Salesforce versions = 2.2.13...

BIT-JENKINS-2026-70430

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration, allowing attackers with Overall/Manage permission to instantiate arbitrary types related to configuration, including those...

PT-2026-73346

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration, allowing attackers with Overall/Manage permission to instantiate arbitrary types related to configuration, including those...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-100128)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100128 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: fix missing expect put in obj eval nftctexpectobjeval allocates an expectation...

PT-2026-76717

Name of the Vulnerable Software and Affected Versions deepmerge-ts versions prior to 8.0.0 Description The library fails to track visited objects or object pairs during the recursive merging of records. When two input values contain self-references at the same property path, the merge logic...

PT-2026-76816

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.11.6 Description In the handleException function within lib/setup-sandbox.js, the software fails to sanitize the Error.cause property introduced in ES2022. While the function recursively sanitizes SuppressedError.error,...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: thunderbird (UTSA-2026-100877)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100877 advisory. When a file download is specified via the Content-Disposition header, that directive would be ignored if the file was included via a or tag, potentially making a...

CVE-2026-73061

Scriban before 7.2.2 contains an access-modifier bypass vulnerability in TypedObjectAccessor that allows template code to write CLR object properties without setter-visibility checks. Attackers can modify properties with private, internal, or init-only setters, and perform mass assignment on...

CVE-2026-74790

Scriban before 7.0.0 caches TypedObjectAccessor by Type only without considering MemberFilter changes, allowing reused TemplateContext instances to expose members that should be hidden. Attackers can access filtered properties and fields by reusing a TemplateContext after tightening its...

CVE-2024-13784

The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes it possible for unauthenticated attackers to inject a PHP...

CVE-2024-13784 Contact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.8.5 - Unauthenticated PHP Object Injection

The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes it possible for unauthenticated attackers to inject a PHP...

EUVD-2024-55720

The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes it possible for unauthenticated attackers to inject a PHP...

CVE-2024-13784

The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes it possible for unauthenticated attackers to inject a PHP...

CVE-2024-13784

The CVE-2024-13784 entry concerns the WordPress plugin ARForms (Contact Form, Survey, Quiz & Popup Form Builder). Affected versions: all up to and including 1.8.5. Root cause: PHP Object Injection via deserialization of untrusted input from form submissions. Impact requires that a POP chain exist...

CVE-2026-12998

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.55.0.2 via the 'draft' parameter due to missing validation on a user controlled key. This makes it possible for...

CVE-2026-12998

The CVE concerns the Forminator Forms plugin for WordPress (up to version 1.55.0.2) and describes an Insecure Direct Object Reference via the draft parameter, enabling unauthenticated attackers to enumerate sequential form-draft entry IDs and read other users’ saved draft data (names, emails, pho...

CVE-2026-12998 Forminator Forms <= 1.55.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameter

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.55.0.2 via the 'draft' parameter due to missing validation on a user controlled key. This makes it possible for...