CVE-2026-85181

Unauthenticated PHP Object Injection vulnerability in JobSearch versions up to 3.2.0. An attacker can inject malicious PHP objects, potentially leading to arbitrary code execution.

Subscriber privilege escalation vulnerability in Bricksforge versions up to 3.1.8.8, allowing a subscriber to escalate privileges.

Unauthenticated SQL Injection vulnerability in GeoDirectory versions up to 2.8.174. An attacker can inject SQL queries, potentially leading to unauthorized database access.

Unauthenticated SQL Injection vulnerability in VikAppointments Services Booking Calendar versions up to 1.2.20. An attacker can inject SQL queries, potentially leading to unauthorized database access.

Unauthenticated PHP Object Injection vulnerability in Mail Mint versions up to 1.31.0. An attacker can inject malicious PHP objects, potentially leading to arbitrary code execution.

Unauthenticated Broken Access Control vulnerability in YITH Request a Quote for WooCommerce Premium versions before 4.46.0. An attacker can access functions they should not have permission to.

MISP contains an authentication bypass vulnerability in its LDAP and LinOTP authentication components due to insufficient validation of user-supplied credentials. An attacker knowing a valid directory user's email address could submit an empty password, which may be accepted by an LDAP server allowing unauthenticated binds. Additionally, in the LinOTP component, empty passwords could be checked against local MISP password hashes, and LDAP-provisioned accounts could be created with empty local passwords.

Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed WebSocket connections to victim applications. Attackers can open socket.io sessions from arbitrary domains and invoke state variable modifications and action callbacks without CSRF protection.

A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formLogin of the file /boaform/formLogin of the component Boa Web Server. Executing a manipulation of the argument Username can lead to buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled with the certificate authentication policy, CertificateMqttFilter parses an X.509 certificate that the client sends inside the MQTT message payload and treats its Subject DN as the authenticated identity. The certificate is decoded but its signature is never verified and its issuer chain is never validated against any trust store. An attacker who can publish to the MQTT broker can mint a self-signed certificate with CN=Sysop.<cloud>.<org>.arrowhead.eu and dnQualifier=op to gain full management access over MQTT.