PT-2026-81300

Name of the Vulnerable Software and Affected Versions OpenSSL versions prior to 3.5.3-8.1 Description A double free issue exists in the QUIC server when processing an INITIAL packet. The default packet handler port default packet handler creates a QRX QUIC record layer RX object for packet...

QUIC Server May Trigger Double Free When Processing INITIAL Packet

Issue summary: QUIC server may double free QRX QUIC record layer RX object when channel creation fails for initial packet. Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial of Service. There is so far no evidence...

CVE-2026-78265

Unauthenticated PHP Object Injection in The Events Calendar = 6.17.2 versions...

CVE-2026-78262

Unauthenticated PHP Object Injection in WP Project Manager = 4.0.6 versions...

CVE-2026-32563

Subscriber PHP Object Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in logback-core [CVE-2026-10532, CVE-2026-9828]

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in logback-core CVE-2026-10532, CVE-2026-9828. Logback-core is used as part of our microservices. These vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details...

CVE-2026-78265 WordPress The Events Calendar plugin <= 6.17.2 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in The Events Calendar = 6.17.2 versions...

CVE-2026-78265 WordPress The Events Calendar plugin <= 6.17.2 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in The Events Calendar = 6.17.2 versions...

CVE-2026-78265

The Events Calendar WordPress plugin versions

CVE-2026-78262 WordPress WP Project Manager plugin <= 4.0.6 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in WP Project Manager = 4.0.6 versions...

CVE-2026-78262 WordPress WP Project Manager plugin <= 4.0.6 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in WP Project Manager = 4.0.6 versions...

CVE-2026-78262

WP Project Manager (WordPress plugin by WeDevs ) is affected by an unauthenticated PHP Object Injection vulnerability in versions ≤ 4.0.6 . The flaw allows a remote, unauthenticated attacker over the network with low complexity and no user interaction to achieve high impact on confidentiality, in...

CVE-2026-32563 WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...

CVE-2026-32563 WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...

CVE-2026-32563

CVE-2026-32563 is a PHP Object Injection vulnerability in the ACPT (Pro) – Custom Post Types Plugin for WordPress , affecting versions ≤ 2.0.63 . The vulnerability requires Subscriber -level access as stated in the description, though the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) rates Pr...

CVE-2026-71507

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that allows authenticated attackers with third-party creation rights to create, replace, or delete bank account details of any company without requiring read access ...

CVE-2026-71505

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attackers with third-party creation rights to overwrite the WebPortal password of any company by bypassing per-object access checks tha...

CVE-2026-40877

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to PHP object injection in the user preference functionality, which can lead to remote code execution. This issue has been fixed in version 3.2.3...

EUVD-2026-65080

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that allows authenticated attackers with third-party creation rights to create, replace, or delete bank account details of any company without requiring read access ...

CVE-2026-71507

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that allows authenticated attackers with third-party creation rights to create, replace, or delete bank account details of any company without requiring read access ...