EUVD-2026-61016

MyBB is free and open source forum software. Prior to 1.8.40, the User CP Buddy/Ignore List component does not validate reciprocal buddy-list updates correctly. The usercp.php?action=doeditlists delete handler removes the selected entry from the acting user's list and then updates...

CVE-2026-47245 MyBB: Buddy list corruption

MyBB is free and open source forum software. Prior to 1.8.40, the User CP Buddy/Ignore List component does not validate reciprocal buddy-list updates correctly. The usercp.php?action=doeditlists delete handler removes the selected entry from the acting user's list and then updates...

CVE-2026-45125 MyBB: Email User CRLF injection

MyBB is free and open source forum software. Prior to 1.8.40, the Email User controller does not sanitize sender names correctly, resulting in mail header injection. member.php?action=doemailuser accepts the fromname HTTP parameter for guests or the stored username for authenticated users when th...

CVE-2026-45125

MyBB prior to 1.8.40 is vulnerable to mail header injection via the Email User controller. The fromname HTTP parameter (or stored username) is used unsanitized in Return-Path and Reply-To headers when mail_handler is PHP mail, enabling arbitrary header injection via CRLF sequences. CVSS 5.3 (Medi...

EUVD-2026-61011

MyBB is free and open source forum software. Prior to 1.8.40, the Email User controller does not sanitize sender names correctly, resulting in mail header injection. member.php?action=doemailuser accepts the fromname HTTP parameter for guests or the stored username for authenticated users when th...

CVE-2026-74012

Deserialization of Untrusted Data vulnerability in TaxoPress allows Object Injection. This issue affects TaxoPress: from n/a through 3.51.0...

CVE-2026-73397

Unauthenticated Deserialization of untrusted data in Youzify = 1.3.7 versions...

CVE-2026-73380

Unauthenticated PHP Object Injection in Popup by Supsystic = 1.13.0 versions...

CVE-2026-73367

Unauthenticated Remote File Inclusion in Easy Google Maps 1.14.2 versions...

CVE-2026-73376

Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic 1.5.0 versions...

CVE-2026-73366

Unauthenticated PHP Object Injection in Easy Google Maps = 1.13.0 versions...

CVE-2026-73341

Unauthenticated PHP Object Injection in RegistrationMagic = 6.0.9.7 versions...

CVE-2026-66620

Editor PHP Object Injection in OptionTree = 2.7.3 versions...

CVE-2026-32470

Unauthenticated PHP Object Injection in FundEngine = 1.7.9 versions...

CVE-2026-32465

Customer PHP Object Injection in Essential Real Estate = 5.3.3 versions...

CVE-2026-74012 WordPress TaxoPress plugin <= 3.51.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in TaxoPress allows Object Injection. This issue affects TaxoPress: from n/a through 3.51.0...

CVE-2026-74012 WordPress TaxoPress plugin <= 3.51.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in TaxoPress allows Object Injection. This issue affects TaxoPress: from n/a through 3.51.0...

EUVD-2026-60818

Editor PHP Object Injection in TaxoPress = 3.51.0 versions...

CVE-2026-74012

The WordPress TaxoPress plugin (versions ≤ 3.51.0) is vulnerable to PHP Object Injection via its Editor component, exploitable over the network with low privileges, potentially leading to full confidentiality, integrity, and availability impact (CVSS 8.8). PatchStack is the CNA. No exploitation e...

CVE-2026-73397

Unauthenticated Deserialization of untrusted data in Youzify = 1.3.7 versions...