SUSE CVE-2026-74381

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Allow entries in BO caches to be freed When a buffer object is pinned via host1xbopin with a cache, the resulting mapping is kept in the cache so it can be reused on subsequent pins. Each mapping held a reference to...

...[ More ]

ILIAS versions prior to 9.22, versions 10.0 through 10.9, and versions 11.0 through 11.2 contain an unauthenticated PHP object injection vulnerability in the Shibboleth logout functionality. An unauthenticated attacker can manipulate stored session data that is subsequently deserialized without...

PT-2026-84997

n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed-key, switch-case, or class-extension positions resolve against process globals. Authenticated users with workflow-edit permission can mutate host objects through expression...

CVE-2026-82023: Incorrect Authorization

LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authorization vulnerability that allows authenticated attackers with the Instructor role to add answers to quiz questions owned by other instructors by exploiting a missing ownership check on the question answer insert path...

CVE-2026-84753: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Mail Mint = 1.31.0 versions...

PT-2026-84917

A vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hosting the application to read and modify application objects without being authenticated to the SYS600 system itself. Only the SYS600 system users should be permitted to view and modify...

PT-2026-85095

Contributor PHP Object Injection in RTMKit = 2.1.5 versions...

PT-2026-85120

Subscriber Insecure Direct Object References IDOR in WC Ukraine Shipping = 1.22.3 versions...

PT-2026-85125

Deserialization of Untrusted Data CWE-502 in the Elasticsearch machine learning component can lead to remote code execution via Object Injection CAPEC-586. A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface tha...

CVE-2026-84752: Deserialization of Untrusted Data

Contributor PHP Object Injection in RTMKit = 2.1.5 versions...

PT-2026-85096

Name of the Vulnerable Software and Affected Versions Mail Mint versions prior to 1.31.1 Description Mail Mint is subject to PHP Object Injection, a condition where an application deserializes untrusted input, allowing an attacker to inject a PHP Object. While no POP chain a sequence of gadgets...

PT-2026-85205

Name of the Vulnerable Software and Affected Versions WHMCS versions 4.5.0 through 8.13.7 WHMCS versions 8.13.0 through 8.13.7 WHMCS versions 9.0.0 through 9.0.7 Description A missing authorization issue exists in the 2Checkout payment gateway. This flaw allows an unauthenticated user to retrieve...

PT-2026-85119

Unauthenticated PHP Object Injection in JobSearch = 3.2.0 versions...

CVE-2026-84834: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in JobSearch = 3.2.0 versions...

RHCOS 4 : OpenShift Container Platform 4.19.45 (RHSA-2026:60452)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:60452 advisory. - github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 /etc/passwd Injection via HOME env CVE-2026-15809 -...

Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)

Summary The Twig content sandbox replaces config with the redacted SandboxConfig facade and strips Config::get/toArray from the method allowlist GHSA-j274-39qw-32c9, so editor content can't read config secrets via config. That's bypassable: grav is the raw container, offsetget is allow-listed on...

github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object

A flaw was found in Go JOSE, a library for handling JSON Web Encryption JWE objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the...

CVE-2026-84647

In Stapler 2107.v8dfcbe8ed317 and earlier, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Stapler does not restrict the types of objects that can be instantiated via form data binding to those compatible with the expected field type, allowing...

CVE-2026-84646

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML...

EUVD-2026-70120

In Stapler 2107.v8dfcbe8ed317 and earlier, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static fields of the bound configuration object, allowing attackers who can submit configuration forms to modify publi...