Log4j2's FilteredObjectInputStream checks which classes can be rebuilt, but not how large or deep the data can be. Here's how that gap enables an RCE and two gadget-free crashes on a serialized log receiver.

A triage-role GitHub collaborator could move a Claude Code Action run's authorized trigger boundary and inject post-authorization input into a repo-writing job.

A filesystem identity race allowed code confined to Claude Code's macOS Bash sandbox to redirect the host-owned Edit tool and overwrite user-writable files outside the workspace.

A redaction bug (CVE-2026-71511, CVSS 6.5) left Dolibarr's members API exposing every member's password hash to any account that could read member records.

A blind authorization flaw (CVE-2026-71510, CVSS 6.5) let attackers infer hidden Dolibarr salaries and password hashes through yes/no search queries.

An access-control bug (CVE-2026-71509, CVSS 6.5) let Dolibarr employees approve their own expense claims and their team's, bypassing separation of duties.

A mass assignment bug (CVE-2026-71508, CVSS 6.5) let Dolibarr employees rewrite their own salary through a profile update, hidden from the API response.

A BOLA bug (CVE-2026-71507, CVSS 6.5) let low-privilege Dolibarr accounts rewrite supplier bank details and redirect real payment batches.

A wrong-permission bug (CVE-2026-71506, CVSS 6.5) let low-privilege Dolibarr accounts delete real payments, turning paid invoices back into phantom debt.

A BOLA bug (CVE-2026-71505, CVSS 8.1) let low-privilege Dolibarr accounts reset any company's portal password and read their private invoices.

A mass assignment bug (CVE-2026-71504, CVSS 8.3) let a low-privilege Dolibarr account reset the admin's password. See the exploit chain and the fix.

A reflected XSS bug in Dolibarr (CVE-2026-71503, CVSS 9.3) lets attackers mint a hidden admin account from one link. See how it works and how to fix it.