CVE-2026-94076

HighCVSS 8.8/10Last modified Sep 30, 2026

Description

Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 versions.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

VendorProductVersions
SEO SquirrlySEO Plugin by Squirrly SEO<= 14.2.5

References

Timeline

Published
Sep 30, 2026
Last modified
Sep 30, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-940776.5Contributor Cross Site Scripting (XSS) in Safe SVG <= 2.5.0 versions.CVE-2026-940787.1Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.3.1 versions.CVE-2026-940795.3Unauthenticated Broken Access Control in WP User Manager <= 2.9.19 versions.CVE-2026-94089.8A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. Affected by this issue is the function setStaticDhcpRules of the file CVE-2026-940805.3Unauthenticated Broken Access Control in MarketKing <= 2.1.70 versions.CVE-2026-940817.1Unauthenticated Cross Site Scripting (XSS) in WordPress Persistent Login <= 3.1.3 versions.CVE-2026-940827.6Author SQL Injection in Quiz Cat <= 3.1.1 versions.CVE-2026-940839.4Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even thCVE-2026-940849.4Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with CVE-2026-9408910.0A vulnerability was determined in D-Link DIR-868L 2.01b05. This issue affects the function strcpy of the file /webfa_authentication.cgi of tCVE-2026-94094.3A flaw has been found in Sushmi-pal Invoice-System up to a0a3faa16dee2621b231ae227333f5761607283b. This affects an unknown part of the file CVE-2026-940906.3A security flaw has been discovered in JusticeRage Manalyze 1.0.0. The affected element is the function PE::_parse_debug of the file manape/