CVE-2026-86773

Snipe-IT through version 8.6.3 fails to perform object-level authorization in the updateLicense, updateConsumable, updateAccessory, and updateModel endpoints and in the storeModel endpoint for Predefined Kits. The existing check authorizes only the parent Predefined Kit update on PredefinedKit an...

CVE-2026-86773 Snipe-IT 8.6.3 Broken Access Control via Kit Update Endpoints

Snipe-IT through version 8.6.3 fails to perform object-level authorization in the updateLicense, updateConsumable, updateAccessory, and updateModel endpoints and in the storeModel endpoint for Predefined Kits. The existing check authorizes only the parent Predefined Kit update on PredefinedKit an...

CVE-2026-86773 Snipe-IT 8.6.3 Broken Access Control via Kit Update Endpoints

Snipe-IT through version 8.6.3 fails to perform object-level authorization in the updateLicense, updateConsumable, updateAccessory, and updateModel endpoints and in the storeModel endpoint for Predefined Kits. The existing check authorizes only the parent Predefined Kit update on PredefinedKit an...

CVE-2026-86773

Snipe-IT through version 8.6.3 suffers from broken object-level authorization in the updateLicense, updateConsumable, updateAccessory, and updateModel endpoints, as well as the storeModel endpoint for Predefined Kits . The root cause is that the existing check authorizes only the parent Predefine...

EUVD-2026-74950

Snipe-IT through version 8.6.3 fails to perform object-level authorization in the updateLicense, updateConsumable, updateAccessory, and updateModel endpoints and in the storeModel endpoint for Predefined Kits. The existing check authorizes only the parent Predefined Kit update on PredefinedKit an...

CVE-2024-58381 PocketMine-MP before 5.11.1 Denial of Service via LoginPacket

PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processing that allows remote attackers to crash the server by sending malformed JSON data. Attackers can exploit improper object initialization from scalar JSON types to trigger unset required properties,...

Denial-Of-Service (DoS)

io.micrometer, micrometer-tracing-bridge-brave is vulnerable to a denial-of-service DoS. The vulnerability is due to improper handling of incoming baggage headers, which allows an attacker to send specially crafted or excessive baggage data that causes unbounded object allocation, potentially...

CVE-2026-11363

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.6 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and...

CVE-2026-11363 Ninja Forms <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection via Form Import

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.6 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and...

CVE-2026-11363

CVE-2026-11363 affects the Ninja Forms WordPress plugin (all versions ≤ 3.14.6) with an authenticated PHP Object Injection vulnerability. During form import, WPN_Helper::build_nf_cache() calls $action-&gt;get_settings(), triggering deserialization of untrusted input with no further user interacti...

CVE-2026-11363 Ninja Forms <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection via Form Import

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.6 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and...

EUVD-2026-74608

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.6 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and...

UBUNTU-CVE-2026-53938

OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. Prior to version 0.6.2.5, cjose's JWE decryption path for the AES Key Wrap key-management algorithms alg = A128KW, A192KW, A256KW does not validate the length of the attacker-supplied encryptedkey JWE...

UBUNTU-CVE-2026-53939

OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE using an AES-CBC-HMAC content-encryption algorithm A128CBC-HS256, A192CBC-HS384, or A256CBC-HS512 together with any key-management algorithm th...

SUSE CVE-2026-55066

Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/project/views/view/buckets/bucket/tasks accepts a body supplied taskid but TaskBucket.CanUpdate in pkg/models/kanbantaskbucket.go authorizes only the project, view, and bucket from the URL...

CVE-2026-71616

An issue in GPAC (commit c2dee3aff638cd96f9617ac5b17dc2868cd90ef3) allows an attacker to cause a denial of service through the gf_route_media_complete_object() function. The vulnerability is addressed in commit 3c4e6c5b3e0c6fa9b16d55599701a08354538fab. While technical details regarding the specif...

PT-2026-88788

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.6 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and...

PT-2026-89042

Snipe-IT through version 8.6.3 fails to perform object-level authorization in the updateLicense, updateConsumable, updateAccessory, and updateModel endpoints and in the storeModel endpoint for Predefined Kits. The existing check authorizes only the parent Predefined Kit update on PredefinedKit an...

CVE-2026-71616

An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to cause a denial of service via the function gfroutemediacompleteobject. Fixed in 3c4e6c5b3e0c6fa9b16d55599701a08354538fab...

PT-2026-89145

An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to cause a denial of service via the function gf route media complete object. Fixed in 3c4e6c5b3e0c6fa9b16d55599701a08354538fab...