CVE-2026-84834

CVE-2026-84834 affects the WordPress JobSearch plugin in versions ≤ 3.2.0 . The vulnerability is an unauthenticated PHP Object Injection , allowing a remote attacker with no privileges to potentially achieve high impact on confidentiality, integrity, and availability, as reflected by a CVSS 3.1 s...

EUVD-2026-70568

Subscriber Insecure Direct Object References IDOR in WC Ukraine Shipping = 1.22.3 versions...

CVE-2026-84769 WordPress Business Directory plugin <= 6.4.26 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Business Directory = 6.4.26 versions...

CVE-2026-84769 WordPress Business Directory plugin <= 6.4.26 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Business Directory = 6.4.26 versions...

CVE-2026-84769

CVE-2026-84769 affects the WordPress Business Directory plugin in versions

EUVD-2026-70577

Unauthenticated Insecure Direct Object References IDOR in Business Directory = 6.4.26 versions...

CVE-2026-84753 WordPress Mail Mint plugin <= 1.31.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Mail Mint = 1.31.0 versions...

CVE-2026-84753 WordPress Mail Mint plugin <= 1.31.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Mail Mint = 1.31.0 versions...

CVE-2026-84753

CVE-2026-84753 affects the WordPress Mail Mint plugin in versions 1.31.0 and below , where an unauthenticated PHP Object Injection flaw allows a remote attacker to inject arbitrary serialized objects into the application. The vulnerability is rated CVSS 9.8 (CRITICAL) with high impact to confiden...

EUVD-2026-70589

Unauthenticated PHP Object Injection in Mail Mint = 1.31.0 versions...

EUVD-2026-70590

Contributor PHP Object Injection in RTMKit = 2.1.5 versions...

CVE-2026-84752 WordPress RTMKit plugin <= 2.1.5 - PHP Object Injection vulnerability

Contributor PHP Object Injection in RTMKit = 2.1.5 versions...

CVE-2026-84752 WordPress RTMKit plugin <= 2.1.5 - PHP Object Injection vulnerability

Contributor PHP Object Injection in RTMKit = 2.1.5 versions...

CVE-2026-84752

CVE-2026-84752 affects the WordPress RTMKit plugin (Rometheme for Elementor) in versions 2.1.5 and earlier . The vulnerability is a PHP Object Injection that can be exploited by a user with Contributor privileges, resulting in high impact on confidentiality, integrity, and availability (CVSS 8.8 ...

CVE-2026-84647

A flaw was found in Stapler, a web framework included in Jenkins. This vulnerability allows an attacker with 'Overall/Read' permission to instantiate objects related to configuration through form data binding. The system does not properly restrict the types of objects that can be created, enablin...

CVE-2026-83557

A flaw was found in jackson-databind. This vulnerability allows a remote attacker to control object creation by exploiting an incomplete list of restricted types in the DefaultBaseTypeLimitingValidator. By crafting malicious input, an attacker can cause the application to create arbitrary file...

EUVD-2026-70482

Helicone's VaultManager.getDecryptedProviderKeyById function in the GET /v1/vault/key/providerKeyId endpoint fails to validate the requester's organization against the vault key's organization identifier. Attackers with admin or owner privileges in any organization can retrieve decrypted upstream...

CVE-2026-85135 ILIAS MediaPool ZipAdapter.php uploadMultipleSubtitleFileObject unrestricted upload

A security flaw has been discovered in ILIAS up to 9.21/10.9/11.2. This affects the function ilObjMediaObjectGUI::uploadMultipleSubtitleFileObject of the file Services/Repository/Service/Resources/ZipAdapter.php of the component MediaPool. The manipulation results in unrestricted upload. The atta...

CVE-2026-85170

n8n versions before 1.123.73, 2.35.4, and 2.36.2 pass message content in the Gmail v1 and Brevo nodes to the mail composer without verifying it is a string. An authenticated user able to run a workflow can supply an expression that resolves to an object carrying a path or href property, causing t...

CVE-2026-85170 n8n before 1.123.73 Local File Read and SSRF via Gmail and Brevo nodes

n8n versions before 1.123.73, 2.35.4, and 2.36.2 pass message content in the Gmail v1 and Brevo nodes to the mail composer without verifying it is a string. An authenticated user able to run a workflow can supply an expression that resolves to an object carrying a path or href property, causing t...