WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕CWE CWE-502✕
Overview 3,708 matches · 508 in Waratek scope · 395 protected · 174 exploited · 77 CISA KEV · 242 public PoC · 162 EPSS ≥ 0.5
3,708matches 508in Waratek scope13.7% 395protected10.7% 174exploited4.7% 77CISA KEV2.1% 242public PoC6.5% 162EPSS ≥ 0.54.4%
Protected by Waratek 395 10.7% Rule in development 0 0.0% Mitigation candidate 20 0.5% No exploit published 93 2.5% Outside Waratek scope 17 0.5% Not applicable 3,182 85.8% Withdrawn CVE 1 0.0%
Critical 1,539 41.5% High 1,793 48.4% Medium 284 7.7% Low 89 2.4% None 0 0.0% Unknown 3 0.1%
blocked by ARMR today 395 10.7% partly blocked 0 0.0% not blocked 3,313 89.3% not established 0 0.0% unrecorded 0 0.0%
Exploited 174 4.7% Working exploit published 89 2.4% Proof of concept only 507 13.7% Forecast only 42 1.1% No public exploit 2,896 78.1%
split by peak 1,399 / year
Withdrawn CVE: 1Not applicable: 3,182Outside Waratek scope: 17No exploit published: 93Mitigation candidate: 20Protected by Waratek: 395 Unknown: 3Low: 89Medium: 284High: 1,793Critical: 1,539 not blocked: 3,313blocked by ARMR today: 395 No public exploit: 2,896Forecast only: 42Proof of concept only: 507Working exploit published: 89Exploited: 174
20031 Not applicable1 Critical1 not blocked1 No public exploit1 20040 20050 20060 20071 Not applicable1 Medium1 not blocked1 Working exploit published1 20080 20090 20102 Not applicable2 High2 not blocked2 No public exploit2 20112 Protected by Waratek1 Not applicable1 High1 Medium1 blocked by ARMR today1 not blocked1 Proof of concept only1 No public exploit1 20123 Not applicable3 Critical2 Medium1 not blocked3 Working exploit published1 No public exploit2 20133 Protected by Waratek1 Mitigation candidate1 Not applicable1 Critical1 High2 blocked by ARMR today1 not blocked2 Working exploit published1 No public exploit2 20142 Protected by Waratek2 High2 blocked by ARMR today2 No public exploit2 20154 Protected by Waratek3 Outside Waratek scope1 Critical3 High1 blocked by ARMR today3 not blocked1 Exploited1 Working exploit published1 No public exploit2 201612 Protected by Waratek6 Mitigation candidate1 Not applicable5 Critical8 High4 blocked by ARMR today6 not blocked6 Exploited1 Working exploit published2 No public exploit9 201770 Protected by Waratek20 No exploit published5 Not applicable45 Critical47 High21 Medium2 blocked by ARMR today20 not blocked50 Exploited6 Working exploit published9 Proof of concept only2 No public exploit53 2018129 Protected by Waratek33 No exploit published6 Outside Waratek scope3 Not applicable87 Critical60 High62 Medium7 blocked by ARMR today33 not blocked96 Exploited7 Working exploit published10 Proof of concept only1 Forecast only1 No public exploit110 2019135 Protected by Waratek29 No exploit published5 Outside Waratek scope1 Not applicable100 Critical79 High51 Medium4 Low1 blocked by ARMR today29 not blocked106 Exploited11 Working exploit published10 Proof of concept only6 Forecast only3 No public exploit105 2020163 Protected by Waratek41 Mitigation candidate7 No exploit published19 Outside Waratek scope1 Not applicable95 Critical74 High80 Medium6 Low3 blocked by ARMR today41 not blocked122 Exploited11 Working exploit published6 Proof of concept only10 Forecast only2 No public exploit134 2021227 Protected by Waratek33 Mitigation candidate7 No exploit published23 Outside Waratek scope3 Not applicable160 Withdrawn CVE1 Critical98 High117 Medium11 Unknown1 blocked by ARMR today33 not blocked194 Exploited19 Working exploit published9 Proof of concept only9 Forecast only15 No public exploit175 2022185 Protected by Waratek32 Mitigation candidate2 No exploit published7 Outside Waratek scope1 Not applicable143 Critical83 High93 Medium7 Low2 blocked by ARMR today32 not blocked153 Exploited12 Working exploit published4 Proof of concept only31 Forecast only5 No public exploit133 2023271 Protected by Waratek42 Mitigation candidate1 No exploit published4 Outside Waratek scope1 Not applicable223 Critical129 High127 Medium15 blocked by ARMR today42 not blocked229 Exploited20 Working exploit published5 Proof of concept only47 Forecast only8 No public exploit191 2024434 Protected by Waratek26 Mitigation candidate1 Outside Waratek scope1 Not applicable406 Critical180 High212 Medium38 Low4 blocked by ARMR today26 not blocked408 Exploited24 Working exploit published9 Proof of concept only69 Forecast only7 No public exploit325 2025665 Protected by Waratek34 Outside Waratek scope4 Not applicable627 Critical260 High282 Medium94 Low29 blocked by ARMR today34 not blocked631 Exploited29 Working exploit published10 Proof of concept only124 Forecast only1 No public exploit501 20261,399 Protected by Waratek92 No exploit published24 Outside Waratek scope1 Not applicable1,282 Critical514 High736 Medium97 Low50 Unknown2 blocked by ARMR today92 not blocked1,307 Exploited33 Working exploit published11 Proof of concept only207 No public exploit1,148
200420062008201020122014201620182020202220242026
3,708 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 3 of 38 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-107436 High 2026-10-18 Not applicable No public exploit Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials strong-testimonials allows Object Injection.This issue affects Strong Testimonials: from n/a through 3.3.12.
CVE-2026-81344 Medium 2026-10-17 Not applicable No public exploit The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may be instantiated when it deserialises stored post content that is rendered on public-facing pages, allowing high-privilege users such as administrators to inject a PHP object which, given a suitable POP chain in another installed ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 or in WordPress core, can be leveraged to achieve remote code execution.
CVE-2026-104736 Critical 2026-10-17 Not applicable Exploited The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The value is passed through sanitize_text_field(), which does not strip serialized object syntax, then stored in the LearnPress session table and later fed to LP_Helper::maybe_unserialize() → unserialize() (without an allowed_classes restriction) by LP_Session_Handler::get() on subsequent requests. This makes it possible for unauthenticated attackers to inject a PHP Object.
CVE-2026-104734 High 2026-10-17 Not applicable No public exploit The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.3.2 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. By default, Editor-level users are granted FULL_ACCESS to the plugin's import endpoint via the KIRKI_USERS_DEFAULT_FULL_ACCESS configuration, meaning exploitation is possible at Editor privilege level rather than being restricted to administrators alone.
CVE-2026-97296 High 2026-10-16 Not applicable No public exploit Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity Forms gravityforms allows Object Injection.This issue affects Gravity Forms: from n/a before 3.1.1.
CVE-2026-75941 High 2026-10-16 Not applicable No public exploit A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market, that could allow an attacker on the same logical network to execute arbitrary code.
CVE-2026-64610 Critical 2026-10-16 Not applicable No public exploit Deserialization of Untrusted Data vulnerability in Apache Kylin. Unsafe Java deserialization could happen from a broken external cache service. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
CVE-2026-111628 Low 2026-10-16 Not applicable No public exploit 10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta. Attackers can store a serialized PHP string as meta, which set_meta() in includes/utils.php unserializes on the destination site, storing attacker-defined objects whose impact depends on loaded gadget classes.
CVE-2026-104932 High 2026-10-16 Not applicable No public exploit The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replace_all function. This allows authenticated attackers, with subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code.
CVE-2026-104730 Critical 2026-10-16 Not applicable No public exploit The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.4 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. If a POP chain is present via an additional plugin or theme installed on the target system, the attacker can store the malicious payload unauthenticated via the public favorites page and trigger deserialization by viewing any image in a non-viewable or private gallery.
CVE-2026-47218 Critical 2026-10-15 Not applicable No public exploit runwasi facilitates running Wasm and WASI workloads managed by containerd. Prior to 0.6.1, containerd-shim-wasmtime-v1 can treat Wasmtime precompiled bytes supplied directly in an OCI image layer as a trusted artifact from the precompile-cache path and deserialize them as native code. An attacker who causes a victim to run a crafted image can bypass WebAssembly validation and execute native code in the shim zygote process, gaining the filesystem, environment, credentials, networking, and Linux syscall access available to the workload container. Downstream shims built with runwasi's containerd-shim-wasm precompile-cache API are also affected if they implement Compiler and trust executable precompiled artifacts from OCI image layers; the 0.6.1 boundary applies specifically to containerd-shim-wasmtime and does not independently certify downstream product releases. The flaw escapes the WASI sandbox to the workload container boundary, but it does not by itself bypass container isolation or provide direct host code execution. This issue is fixed in version 0.6.1.
CVE-2026-47168 Critical 2026-10-15 Not applicable No public exploit EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can supply crafted serialized PHP object data that is stored in background MassAction or Export parameters and later deserialized by the application. The deserialization paths do not restrict allowed classes, allowing attacker-controlled object instantiation and arbitrary code execution on the server. This issue is fixed in version 9.3.7.
CVE-2026-111160 High 2026-10-15 Not applicable Proof of concept only LightLLM through 1.2.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the inference worker by supplying the internal pd_kv_trans_params field to the /generate endpoint. Attackers can send a single request whose parameters cause pickle.loads to fail in InferSamplingParams, killing the inference thread while /health stays up and all later requests hang until restart.
CVE-2026-111094 Critical 2026-10-15 Not applicable No public exploit In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible
CVE-2026-110874 High 2026-10-15 Not applicable No public exploit Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize() in functions.lib.php, which calls unserialize() without class restrictions when json_decode() fails. Attackers able to write stored extrafields, export configurations or blocked log entries can plant serialized objects that trigger gadget chains for code execution or file manipulation.
CVE-2026-110812 Critical 2026-10-15 Not applicable No public exploit Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials. To remediate this issue, users not enrolled in auto-update should upgrade to Amazon Neptune engine version 1.5.0.0.(Backports to 1.4.8.1 and 1.4.7.1)
CVE-2026-109686 Critical 2026-10-15 Not applicable No public exploit Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Object Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.
CVE-2026-102469 Critical 2026-10-15 Protected by Waratek No public exploit In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) contains DRDA protocol handling code that deserializes User Defined Type (UDT) column data using a bare ObjectInputStream.readObject() call with no ObjectInputFilter or class allowlist. This code path is triggered when a DRDA server sends a result set with a column tagged as UDT (FDOCA protocol LID 0x50). However, DB2 does not support this type of UDT. The FDOCA 0x50 type is never sent by a legitimate DB2 server. Nevertheless, a malicious or man-in-the-middle DRDA server could craft a response with a 0x50-tagged column, causing the client to deserialize arbitrary attacker-controlled bytes on the Vert.x event loop before any application code can inspect or reject the data. If a Java deserialization gadget chain is present on the application's classpath, this enables remote code execution. Without a gadget chain, denial of service is possible via crafted object graphs. TLS is disabled by default, making man-in-the-middle exploitation feasible. The impacted component is io.vertx:vertx-db2-client.
CVE-2026-97278 High 2026-10-14 Not applicable No public exploit Deserialization of Untrusted Data vulnerability in WP SYNTEX Polylang polylang allows Object Injection.This issue affects Polylang: from n/a through 3.8.9.
CVE-2026-73793 High 2026-10-14 Not applicable No public exploit HPE NonStop Middleware software has secret key handling and data deserialization vulnerability.
CVE-2026-55573 Critical 2026-10-14 Not applicable Proof of concept only e107 is a content management system (CMS). Prior to 2.3.7, install.php decodes the attacker-controlled previous_steps POST parameter and passes it to unserialize() at file scope and again in the e_install constructor without restricting allowed classes. The installer remains accessible after a normal installation, and a crafted object graph using the bundled GuzzleHttp\Psr7\PumpStream class can flow through paths.hash into site_path, where string coercion invokes an attacker-controlled callable. An unauthenticated attacker who can reach install.php can therefore execute arbitrary PHP functions with the web server process's privileges, leading to full server compromise. This issue is fixed in version 2.3.7.
CVE-2026-110761 High 2026-10-14 Not applicable No public exploit ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test creation or import permission to deserialize arbitrary objects via crafted Test archives. Attackers can inject a malicious tst_sequence sequence attribute that is passed to unserialize(), abusing Guzzle or Monolog gadget chains to write PHP files and execute code.
CVE-2026-108291 Critical 2026-10-14 Not applicable Exploited Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates allows Object Injection.This issue affects Affiliates: from n/a through 7.0.1.
CVE-2026-106599 High 2026-10-14 Not applicable No public exploit Deserialization of Untrusted Data vulnerability in Brainstorm Force SureCart surecart allows Object Injection.This issue affects SureCart: from n/a through 4.9.3.
CVE-2026-104764 High 2026-10-14 Not applicable No public exploit The Post Export Import with Media plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.17.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
CVE-2026-96186 High 2026-10-13 Not applicable No public exploit Deserialization of untrusted data in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.
CVE-2026-93905 High 2026-10-13 Protected by Waratek No public exploit IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances.
CVE-2026-88091 High 2026-10-13 Not applicable No public exploit Deserialization of untrusted data in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.
CVE-2026-87697 High 2026-10-13 Not applicable No public exploit Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
CVE-2026-87692 High 2026-10-13 Not applicable No public exploit Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
CVE-2026-85900 High 2026-10-13 Not applicable No public exploit Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2026-83520 High 2026-10-13 Not applicable No public exploit Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
CVE-2026-70035 High 2026-10-13 Not applicable No public exploit Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network.
CVE-2026-65674 High 2026-10-13 Not applicable No public exploit Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.
CVE-2026-65180 High 2026-10-13 Not applicable No public exploit NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and data tampering.
CVE-2026-65110 High 2026-10-13 Not applicable No public exploit NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where, an attacker could cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.
CVE-2026-49950 Critical 2026-10-13 Not applicable No public exploit Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the actor-pool TCP channel. Attackers can exploit SocketChannel.recv() passing unvalidated data to cloudpickle.loads(), which triggers pickle __reduce__ gadget execution before message type validation, achieving remote code execution as the server process which commonly runs as root on GPU nodes.
CVE-2026-108958 Low 2026-10-13 Not applicable Proof of concept only A weakness has been identified in TensorLayer up to 2.2.4. This affects the function load_hdf5_graph of the file tensorlayer/files/utils.py of the component HDF5 Loading. Executing a manipulation of the argument model_config can lead to deserialization. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-108947 Low 2026-10-13 Not applicable Proof of concept only A flaw has been found in yoshitomo-matsubara torchdistill up to 1.1.5. This affects the function load_ckpt of the file torchdistill/common/main_util.py. Executing a manipulation of the argument src_ckpt can lead to deserialization. The attack needs to be launched locally. The exploit has been published and may be used. The project maintainer explains: "This is very similar to an internal report that GH auto-generated for the owner before, which I found tolerable for this project at that time. So I will close this as duplicate."
CVE-2026-105442 High 2026-10-13 Protected by Waratek No public exploit IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause a denial of service caused by an insecure deserialization in the messaging service.
CVE-2026-105013 High 2026-10-13 Not applicable No public exploit Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2026-100214 High 2026-10-13 Not applicable No public exploit Deserialization of untrusted data in Dynamics Business Central allows an authorized attacker to execute code over a network.
CVE-2026-52903 High 2026-10-12 Not applicable No public exploit A deserialization of untrusted data vulnerability was found in ManageIQ. The YamlLoadAliases module overrides YAML.safe_load to silently fall back to YAML.unsafe_load in production when a Psych::DisallowedClass error occurs. An authenticated attacker with dialog import access can exploit this to achieve remote code execution by uploading a crafted YAML payload that triggers the fallback and deserializes arbitrary Ruby objects. Red Hat CloudForms, which was based on ManageIQ, has reached End of Life and is no longer supported. No errata or patches will be issued. This CVE is being assigned for the benefit of the ManageIQ community and downstream consumers.
CVE-2026-12613 High 2026-10-12 Not applicable No public exploit Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and Ministry of Justice General Directorate of Information Technology UYAP Document Editor on MacOS allows Object Injection. This issue affects UYAP Document Editor: before 5.4.20; UYAP Document Editor: before 5.4.21.
CVE-2026-109391 Critical 2026-10-12 Not applicable No public exploit Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POST /api/1.0/symbolication endpoint. When occurrences referencing the attacker-controlled symbolication UUID are symbolicated, the stored values are passed to YAML.load with SafeYAML in unsafe mode, enabling arbitrary Ruby object deserialization and potential code execution.
CVE-2026-109361 High 2026-10-12 Not applicable No public exploit MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessing_file path read from inference_information.json without confining it to the results directory. Attackers who can modify inference_information.json can point it at a malicious pickle elsewhere on the filesystem to execute code when predict_ensemble_postprocessing runs.
CVE-2026-109360 High 2026-10-12 Not applicable Proof of concept only MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weights fetched over plaintext HTTP. Attackers can substitute a crafted .pth file that load_state_dict_from_url unpickles without weights_only=True, executing code when SEResNet50 or other SENet models are constructed with pretrained=True.
CVE-2026-109237 High 2026-10-12 Not applicable No public exploit Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API clients to construct forbidden config objects by wrapping them in dict-type wrappers. Attackers can send a laundered LLMConfig with api_token set to an env reference via /config/dump to read SECRET_KEY and provider keys, enabling admin JWT forgery.
CVE-2026-94676 High 2026-10-10 Not applicable No public exploit Deserialization of Untrusted Data vulnerability in Tainacan Community Tainacan tainacan allows Object Injection.This issue affects Tainacan: from n/a through 1.3.0.
CVE-2026-93945 Critical 2026-10-10 Not applicable No public exploit Deserialization of Untrusted Data vulnerability in Axiomthemes Balance balance allows Object Injection.This issue affects Balance: from n/a through 1.12.0.
CVE-2026-93944 Critical 2026-10-10 Not applicable No public exploit Deserialization of Untrusted Data vulnerability in ThemeREX Group Camelia camelia allows Object Injection.This issue affects Camelia: from n/a through 1.2.15.
CVE-2026-93943 Critical 2026-10-10 Not applicable No public exploit Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex allows Object Injection.This issue affects Convex: from n/a through 1.16.0.
CVE-2026-93942 Critical 2026-10-10 Not applicable No public exploit Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell allows Object Injection.This issue affects Dwell: from n/a through 1.16.0.
CVE-2026-93941 Critical 2026-10-10 Not applicable No public exploit Deserialization of Untrusted Data vulnerability in ThemeREX Group Edema edema allows Object Injection.This issue affects Edema: from n/a through 1.2.2.2.
CVE-2026-93940 Critical 2026-10-10 Not applicable No public exploit Deserialization of Untrusted Data vulnerability in ThemeREX Group Greeny greeny allows Object Injection.This issue affects Greeny: from n/a through 2.10.0.
CVE-2026-93938 Critical 2026-10-10 Not applicable No public exploit Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogwords hogwords allows Object Injection.This issue affects Hogwords: from n/a through 1.2.7.
CVE-2026-93937 Critical 2026-10-10 Not applicable No public exploit Deserialization of Untrusted Data vulnerability in ThemeREX Group Hygia hygia allows Object Injection.This issue affects Hygia: from n/a through 1.21.0.
CVE-2026-93936 Critical 2026-10-10 Not applicable No public exploit Deserialization of Untrusted Data vulnerability in ThemeREX Group IPharm ipharm allows Object Injection.This issue affects IPharm: from n/a through 1.2.4.
CVE-2026-93935 Critical 2026-10-10 Not applicable No public exploit Deserialization of Untrusted Data vulnerability in ThemeREX Group Let's Play playhockey allows Object Injection.This issue affects Let's Play: from n/a through 1.1.15.
CVE-2026-93934 Critical 2026-10-10 Not applicable No public exploit Deserialization of Untrusted Data vulnerability in ThemeREX Group Partiso partiso allows Object Injection.This issue affects Partiso: from n/a through 1.1.13.
CVE-2026-93933 Critical 2026-10-10 Not applicable No public exploit Deserialization of Untrusted Data vulnerability in ThemeREX Group Rosalinda rosalinda allows Object Injection.This issue affects Rosalinda: from n/a through 1.2.4.
CVE-2026-93932 Critical 2026-10-10 Not applicable No public exploit Deserialization of Untrusted Data vulnerability in ThemeREX Group Smart Casa smart-casa allows Object Injection.This issue affects Smart Casa: from n/a through 1.0.12.
CVE-2026-93931 Critical 2026-10-10 Not applicable No public exploit Deserialization of Untrusted Data vulnerability in ThemeREX Group Smash smash allows Object Injection.This issue affects Smash: from n/a through 1.12.0.
CVE-2026-93930 Critical 2026-10-10 Not applicable No public exploit Deserialization of Untrusted Data vulnerability in ThemeREX Group Tantra tantra allows Object Injection.This issue affects Tantra: from n/a through 2.9.0.
CVE-2026-93929 Critical 2026-10-10 Not applicable No public exploit Deserialization of Untrusted Data vulnerability in ThemeREX Group Travesia travesia allows Object Injection.This issue affects Travesia: from n/a through 1.1.16.
CVE-2026-93927 Critical 2026-10-10 Not applicable No public exploit Deserialization of Untrusted Data vulnerability in Axiomthemes Veto veto allows Object Injection.This issue affects Veto: from n/a through 1.6.0.
CVE-2026-81797 Critical 2026-10-10 Not applicable No public exploit Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions.
CVE-2026-78535 Critical 2026-10-10 Not applicable No public exploit Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.
CVE-2026-78533 Critical 2026-10-10 Not applicable No public exploit Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.
CVE-2026-78531 Critical 2026-10-10 Not applicable No public exploit Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.
CVE-2026-78529 Critical 2026-10-10 Not applicable No public exploit Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.
CVE-2026-66569 Critical 2026-10-10 Not applicable No public exploit Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.
CVE-2026-66568 Critical 2026-10-10 Not applicable No public exploit Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.
CVE-2026-66567 Critical 2026-10-10 Not applicable No public exploit Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.
CVE-2026-66565 Critical 2026-10-10 Not applicable No public exploit Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions.
CVE-2026-66564 Critical 2026-10-10 Not applicable No public exploit Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.
CVE-2026-66563 Critical 2026-10-10 Not applicable No public exploit Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.
CVE-2026-66483 Critical 2026-10-10 Not applicable No public exploit Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.
CVE-2026-66482 Critical 2026-10-10 Not applicable No public exploit Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions.
CVE-2026-62130 High 2026-10-10 Not applicable No public exploit Shop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency <= 5.5.8 versions.
CVE-2026-62125 Critical 2026-10-10 Not applicable No public exploit Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions.
CVE-2026-62124 Critical 2026-10-10 Not applicable No public exploit Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions.
CVE-2026-62123 Critical 2026-10-10 Not applicable No public exploit Unauthenticated PHP Object Injection in Invetex <= 2.18 versions.
CVE-2026-62120 Critical 2026-10-10 Not applicable No public exploit Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.
CVE-2026-62090 Critical 2026-10-10 Not applicable No public exploit Unauthenticated PHP Object Injection in WineShop <= 3.20 versions.
CVE-2026-62087 Critical 2026-10-10 Not applicable No public exploit Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions.
CVE-2026-62086 Critical 2026-10-10 Not applicable No public exploit Unauthenticated PHP Object Injection in Juno <= 2.25 versions.
CVE-2026-62077 Critical 2026-10-10 Not applicable No public exploit Unauthenticated PHP Object Injection in Avala <= 1.1.4 versions.
CVE-2026-62076 Critical 2026-10-10 Not applicable No public exploit Unauthenticated PHP Object Injection in Kalles <= 1.1.7.1 versions.
CVE-2026-62054 Critical 2026-10-10 Not applicable No public exploit Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions.
CVE-2026-62053 Critical 2026-10-10 Not applicable No public exploit Unauthenticated PHP Object Injection in Wine House <= 3.20 versions.
CVE-2026-62052 Critical 2026-10-10 Not applicable No public exploit Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions.
CVE-2026-62051 Critical 2026-10-10 Not applicable No public exploit Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions.
CVE-2026-62050 Critical 2026-10-10 Not applicable No public exploit Unauthenticated PHP Object Injection in Splendour <= 1.23 versions.
CVE-2026-62046 Critical 2026-10-10 Not applicable No public exploit Deserialization of Untrusted Data vulnerability in ThemeREX Group Gutentype gutentype allows Object Injection.This issue affects Gutentype: from n/a through 2.1.12.
CVE-2026-62045 Critical 2026-10-10 Not applicable No public exploit Deserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers booklovers allows Object Injection.This issue affects Booklovers: from n/a through 2.13.0.
CVE-2026-62044 High 2026-10-10 Not applicable No public exploit Deserialization of Untrusted Data vulnerability in bPlugins Super Video Player super-video-player allows Object Injection.This issue affects Super Video Player: from n/a through 1.8.13.
CVE-2026-62021 High 2026-10-10 Not applicable No public exploit Subscriber PHP Object Injection in Angio <= 1.1.1 versions.
CVE-2026-42723 Critical 2026-10-10 Not applicable No public exploit Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions.
CVE-2026-42719 Critical 2026-10-10 Not applicable No public exploit Subscriber PHP Object Injection in Dynamic User Directory <= 2.4 versions.
‹ prev page 3 of 38 next ›