Skip to content
OpenAdvisories

Archive

1 May 2026

Vulnerabilities first published on this day (UTC), newest first.

3 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-42778 Public exploit

    Apache MINA: CWE-502 Deserialization of Untrusted Data (take 2)

    The fix for CVE-2026-41409 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description: The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname allowlist of classes allowed to be deseri…

  • Critical 9.8
    CVE-2026-42779 Public exploit

    Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE (take 2)

    The fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description: Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the cl…

  • Critical 9.8
    CVE-2026-7567 Public exploit

    Temporary Login <= 1.0.0 - Authentication Bypass to Account Takeover

    The Temporary Login plugin for WordPress is vulnerable to Authentication Bypass in versions up to and including 1.0.0. This is due to improper input validation in the maybe_login_temporary_user() function, which fails to verify that the 'temp-login-token' GET…