PT-2026-90497

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.5.3 Description An authorization flaw exists during Express entry submissions where the system validates the authorization check against the entity of the posted form instead of the entity identified by the...

CVE-2024-12145: Missing Authorization

The BuddyPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 14.3.3 via the bpnotificationsactionbulkmanage due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level...

Fedora 44 : dokuwiki (2026-9bbb604ea2)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-9bbb604ea2 advisory. Backport object injection RCE fix - see https://github.com/dokuwiki/dokuwiki/issues/4752 Tenable has extracted the preceding description block directly from...

Linux Distros Unpatched Vulnerability : CVE-2026-88046

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone core does not reject...

PT-2026-90126

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Netlink handlers for tunnel create, tunnel modify, session create, and session modify send multicast notifications via helpers. These helpers may fail during message allocation, encoding...

PT-2026-90163

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the iommufd access notify unmap function where internal accesses are skipped because they lack an external unmap callback. The process incorrectly calls iommufd lock o...

PT-2026-90076

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description An issue exists in the fuse-io-uring transport where request headers are copied directly to and from userspace. Specifically, the fuse uring copy to ring function copies req-in.h and the fus...

PT-2026-90020

Unauthenticated PHP Object Injection in Everest Forms = 3.6.0 versions...

PT-2026-90598

Name of the Vulnerable Software and Affected Versions Tutor LMS versions prior to 4.0.8 Description The Tutor LMS plugin for WordPress is affected by a PHP Object Injection issue that can lead to remote code execution on over 100,000 sites worldwide. The flaw exists in the tutor save withdraw...

PT-2026-90032

Contributor Insecure Direct Object References IDOR in Starter Templates = 4.7.5 versions...

PT-2026-89746

The Woo PDF Invoice Builder plugin also distributed as "PDF Builder for WooCommerce" for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.8. This is due to the InspectOrder AJAX handler woocommerce-pdf-invoice-ajax.php:513, registered on wp aja...

PT-2026-90028

Contributor Insecure Direct Object References IDOR in Slim SEO = 4.10.0 versions...

PT-2026-90023

Unauthenticated PHP Object Injection in Masteriyo - LMS = 3.4.0 versions...

PT-2026-90021

Unauthenticated PHP Object Injection in ThemeREX Addons 2.45.0 versions...

CVE-2026-62107: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Masteriyo - LMS = 3.4.0 versions...

CVE-2026-62105: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in ThemeREX Addons 2.45.0 versions...

CVE-2026-62103: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Everest Forms = 3.6.0 versions...

CVE-2026-11496: Missing Authorization

The Woo PDF Invoice Builder plugin also distributed as "PDF Builder for WooCommerce" for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.8. This is due to the InspectOrder AJAX handler woocommerce-pdf-invoice-ajax.php:513, registered on...

PT-2026-90311

Name of the Vulnerable Software and Affected Versions Linux kernel version 6.12.95 Description A race condition exists in the fsnotify system affecting fanotify and inotify. When a mark receives a new event bit, the system may skip recalculating the object mask if the cached aggregate already...

PT-2026-96360

In the Linux kernel, the following vulnerability has been resolved: fsnotify: Fix stale object mask after concurrent mark updates When a mark gets a new event bit, fanotify and inotify may avoid recalculating the object mask if the cached aggregate already contains that bit. This is racy with a...