rootpwn

medium · CVSS v3 5.5 · CVSS v4 5.1 · EPSS 0.00337

CVE-2026-95928

A security flaw has been discovered in recommenders-team recommenders up to 1.2.1. This impacts the function pickle.load…

Description

A security flaw has been discovered in recommenders-team recommenders up to 1.2.1. This impacts the function pickle.load of the file recommenders/models/newsrec/io/mind_iterator.py of the component Dict Loading. Performing a manipulation results in deserialization. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Scores

Severity
medium
CVSS v2
6.5
CVSS v3
5.5
CVSS v4
5.1
EPSS
0.00337

← All CVEs

Related CVEs

medium

CVE-2026-84741

The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details into a public REST API response, allowing unauthenticated users to read the contents of records that have never been published.

View analysis

medium

CVE-2026-86602

The WP Recipe Maker WordPress plugin before 10.8.2 does not perform any capability check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the full content of unpublished recipes.

View analysis

medium

CVE-2026-86603

WP Recipe Maker plugin versions prior to 10.8.2 lack an authorization check on an AJAX endpoint, enabling any logged-in user to view unpublished recipe list IDs and titles. This flaw can expose sensitive content and user data. It affects sites running the vulnerable plugin.

View analysis

medium

CVE-2026-86601

The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page's structured metadata, allowing unauthenticated users to have arbitrary shortcodes executed server side and to read the content of unpublished recipes.

View analysis