37714 matches found
CVE-2026-65571
Unauthenticated PHP Object Injection in 69 Clothing = 1.2.11.1 versions...
CVE-2026-65572
Unauthenticated PHP Object Injection in A.Williams = 1.3.1 versions...
CVE-2026-65573
Unauthenticated PHP Object Injection in Abelle = 1.22 versions...
CVE-2026-65574
Unauthenticated PHP Object Injection in Abogado = 1.18 versions...
CVE-2026-65556
Unauthenticated PHP Object Injection in WPBruiser no- Captcha anti-Spam = 3.1.43 versions...
CVE-2026-65552
Subscriber PHP Object Injection in Export User Data = 2.2.6 versions...
CVE-2026-65549
Author PHP Object Injection in Jeg Kit for Elementor = 3.2.10 versions...
CVE-2026-65523
Unauthenticated Insecure Direct Object References IDOR in Formidable Forms Signature Online Contract Automation = 2.0.1 versions...
CVE-2026-28180
Unauthenticated Insecure Direct Object References IDOR in Mercado Pago payments for WooCommerce = 8.9.0 versions...
CVE-2026-28139
Unauthenticated PHP Object Injection in Ajax Search Lite = 4.14.4 versions...
EUVD-2026-54089
Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to subscribe to any document's event stream and observe another user's segmentation, transcription, import, export and training activity via the objectcls and objectpk values...
CVE-2026-66843
CVE-2026-66843 affects html_sanitize_ex HTML5 scrubber. The vulnerability arises because the object element (data attribute) is not registered in allow_tag_with_uri_attributes/3, and the only guard is a lowercase javascript: prefix. This allows attacker-supplied content to be embedded in a truste...
CVE-2026-66843 html_sanitize_ex HTML5 scrubber keeps attacker-supplied `<object>` elements, allowing untrusted content embedding
Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to load a document of their choosing into a trusted page via the data attribute of an element in sanitized HTML. object is the one URI-bearing element in...
EUVD-2026-54080
Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to load a document of their choosing into a trusted page via the data attribute of an element in sanitized HTML. object is the one URI-bearing element in...
EEF-CVE-2026-66843 html_sanitize_ex HTML5 scrubber keeps attacker-supplied `<object>` elements, allowing untrusted content embedding
Summary Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to load a document of their choosing into a trusted page via the data attribute of an element in sanitized HTML. object is the one URI-bearing...
EUVD-2026-53900
Customer Insecure Direct Object References IDOR in Colissimo Officiel : Méthodes de livraison pour WooCommerce = 2.10.0 versions...
CVE-2026-66692
Customer Insecure Direct Object References IDOR in Colissimo Officiel : Méthodes de livraison pour WooCommerce = 2.10.0 versions...
CVE-2026-66692 WordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.10.0 - Insecure Direct Object References (IDOR) vulnerability
Customer Insecure Direct Object References IDOR in Colissimo Officiel : Méthodes de livraison pour WooCommerce = 2.10.0 versions...
CVE-2026-66692 WordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.10.0 - Insecure Direct Object References (IDOR) vulnerability
Customer Insecure Direct Object References IDOR in Colissimo Officiel : Méthodes de livraison pour WooCommerce = 2.10.0 versions...