CVE-2026-84753: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Mail Mint = 1.31.0 versions...

PT-2026-84917

A vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hosting the application to read and modify application objects without being authenticated to the SYS600 system itself. Only the SYS600 system users should be permitted to view and modify...

PT-2026-85095

Contributor PHP Object Injection in RTMKit = 2.1.5 versions...

PT-2026-85120

Subscriber Insecure Direct Object References IDOR in WC Ukraine Shipping = 1.22.3 versions...

PT-2026-85125

Deserialization of Untrusted Data CWE-502 in the Elasticsearch machine learning component can lead to remote code execution via Object Injection CAPEC-586. A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface tha...

CVE-2026-84752: Deserialization of Untrusted Data

Contributor PHP Object Injection in RTMKit = 2.1.5 versions...

PT-2026-85096

Name of the Vulnerable Software and Affected Versions Mail Mint versions prior to 1.31.1 Description Mail Mint is subject to PHP Object Injection, a condition where an application deserializes untrusted input, allowing an attacker to inject a PHP Object. While no POP chain a sequence of gadgets...

PT-2026-85205

Name of the Vulnerable Software and Affected Versions WHMCS versions 4.5.0 through 8.13.7 WHMCS versions 8.13.0 through 8.13.7 WHMCS versions 9.0.0 through 9.0.7 Description A missing authorization issue exists in the 2Checkout payment gateway. This flaw allows an unauthenticated user to retrieve...

PT-2026-85119

Unauthenticated PHP Object Injection in JobSearch = 3.2.0 versions...

CVE-2026-84834: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in JobSearch = 3.2.0 versions...

Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)

Summary The Twig content sandbox replaces config with the redacted SandboxConfig facade and strips Config::get/toArray from the method allowlist GHSA-j274-39qw-32c9, so editor content can't read config secrets via config. That's bypassable: grav is the raw container, offsetget is allow-listed on...

github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object

A flaw was found in Go JOSE, a library for handling JSON Web Encryption JWE objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the...

CVE-2026-84646

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML...

CVE-2026-84647

In Stapler 2107.v8dfcbe8ed317 and earlier, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Stapler does not restrict the types of objects that can be instantiated via form data binding to those compatible with the expected field type, allowing...

EUVD-2026-70120

In Stapler 2107.v8dfcbe8ed317 and earlier, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static fields of the bound configuration object, allowing attackers who can submit configuration forms to modify publi...

CVE-2026-84654

In Stapler 2107.v8dfcb_e8ed317 and earlier (except 2088.2093.vd7c3e58008a_6 ), which are included in Jenkins 2.579 and earlier (LTS 2.568.2 and earlier), a form data binding vulnerability exists. This flaw allows an attacker capable of submitting configuration forms to modify public static fields...

EUVD-2026-70113

In Stapler 2107.v8dfcbe8ed317 and earlier, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Stapler does not restrict the types of objects that can be instantiated via form data binding to those compatible with the expected field type, allowing...

CVE-2026-84646

The Jenkins automation server is vulnerable in versions 2.579 and earlier (and LTS 2.568.2 and earlier ). An attacker with Overall/Read permission can exploit a flaw where user objects appear as nested field values in other deserialized XML objects. By submitting crafted XML , the attacker can cr...

CVE-2026-14326

The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its custom staff role to modify, disable, or take over appointments belonging to other staff members...

CVE-2023-3360

The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is present on the blog...