CVE-2026-74012

Deserialization of Untrusted Data vulnerability in TaxoPress allows Object Injection. This issue affects TaxoPress: from n/a through 3.51.0...

CVE-2026-73380

Unauthenticated PHP Object Injection in Popup by Supsystic = 1.13.0 versions...

CVE-2026-73376

Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic 1.5.0 versions...

CVE-2026-73366

Unauthenticated PHP Object Injection in Easy Google Maps = 1.13.0 versions...

CVE-2026-73189

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate to CVE-2026-14858...

CVE-2026-73341

Unauthenticated PHP Object Injection in RegistrationMagic = 6.0.9.7 versions...

CVE-2026-66620

Editor PHP Object Injection in OptionTree = 2.7.3 versions...

CVE-2026-32470

Unauthenticated PHP Object Injection in FundEngine = 1.7.9 versions...

CVE-2026-75485 Must-gather: /tmp/kubeconfig retention

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing the oc inspect redaction that would normally sanitize sensitive fields. This exposes proxy basic-auth credentials in the must-gather...

CVE-2026-75485

In Red Hat Advanced Cluster Management for Kubernetes, the must-gather component dumps the cluster Proxy object raw, bypassing oc inspect redaction and exposing proxy basic-auth credentials in the archive. CVSS 5.5 (MEDIUM), local exploit, no in-the-wild exploitation reported. Monitor Red Hat adv...

EUVD-2026-60959

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing the oc inspect redaction that would normally sanitize sensitive fields. This exposes proxy basic-auth credentials in the must-gather...

CVE-2026-75485

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing the oc inspect redaction that would normally sanitize sensitive fields. This exposes proxy basic-auth credentials in the must-gather...

CVE-2026-72359

A flaw was found in the Linux kernel's drm/xe graphics driver. A local user could trigger a NULL pointer dereference when querying memory statistics for a buffer object that has been purged. This issue arises because the driver attempts to access a NULL resource, which can lead to a system crash...

CVE-2026-32465

Customer PHP Object Injection in Essential Real Estate = 5.3.3 versions...

CVE-2026-74012 WordPress TaxoPress plugin <= 3.51.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in TaxoPress allows Object Injection. This issue affects TaxoPress: from n/a through 3.51.0...

CVE-2026-74012

The WordPress TaxoPress plugin (versions ≤ 3.51.0) is vulnerable to PHP Object Injection via its Editor component, exploitable over the network with low privileges, potentially leading to full confidentiality, integrity, and availability impact (CVSS 8.8). PatchStack is the CNA. No exploitation e...

CVE-2026-74012 WordPress TaxoPress plugin <= 3.51.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in TaxoPress allows Object Injection. This issue affects TaxoPress: from n/a through 3.51.0...

EUVD-2026-60818

Editor PHP Object Injection in TaxoPress = 3.51.0 versions...

CVE-2026-74009 WordPress Razorpay for WooCommerce plugin <= 4.8.7 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Razorpay for WooCommerce = 4.8.7 versions...

CVE-2026-73395 WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Booking calendar, Appointment Booking System = 3.2.36 versions...