Total
3617 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-40739 | 2026-10-26 | N/A | 8.1 HIGH | ||
| Unauthenticated PHP Object Injection in LuxeDrive <= 1.4 versions. | |||||
| CVE-2026-39556 | 2026-10-26 | N/A | 8.1 HIGH | ||
| Unauthenticated PHP Object Injection in Konsept <= 1.9 versions. | |||||
| CVE-2026-45134 | 2026-10-26 | N/A | 7.1 HIGH | ||
| LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to LangSmith SDK Python 0.8.0 and JS/TS 0.6.0, the LangSmith SDK's prompt pull methods (pull_prompt / pull_prompt_commit in Python, pullPrompt / pullPromptCommit in JS/TS) fetch and deserialize prompt manifests from the LangSmith Hub. These manifests may contain serialized LangChain objects and model configuration that affect runtime behavior. When pulling a public prompt by owner/name identifier, the manifest content is controlled by an external party, but prior versions of the SDK did not distinguish this from pulling a prompt within the caller's own organization. This vulnerability is fixed in LangSmith SDK Python 0.8.0 and JS/TS 0.6.0. | |||||
| CVE-2026-39560 | 2026-10-26 | N/A | 8.1 HIGH | ||
| Unauthenticated PHP Object Injection in Hiroshi <= 1.5.1 versions. | |||||
| CVE-2026-47161 | 2026-10-26 | N/A | N/A | ||
| RELATE is a web-based courseware package. Prior to commit d66ba5659b459bf1ba56b7109b5f9ecf197cbefb, RELATE LMS configures its Celery workers to accept and deserialize untrusted 'pickle' data. An attacker who can reach the message broker can execute arbitrary commands on the host server. Combined with missing network isolation in the code execution sandbox, this allows an authenticated student to achieve full Remote Code Execution (RCE) on the host system. Commit d66ba5659b459bf1ba56b7109b5f9ecf197cbefb fixes the issue. | |||||
| CVE-2026-39442 | 2026-10-26 | N/A | 8.1 HIGH | ||
| Unauthenticated PHP Object Injection in PressMart <= 1.2.26 versions. | |||||
| CVE-2026-40755 | 2026-10-26 | N/A | 8.1 HIGH | ||
| Unauthenticated PHP Object Injection in TechLink <= 1.3 versions. | |||||
| CVE-2026-40761 | 2026-10-26 | N/A | 8.1 HIGH | ||
| Unauthenticated PHP Object Injection in Valeska <= 1.2.2 versions. | |||||
| CVE-2026-39578 | 2026-10-26 | N/A | 5.5 MEDIUM | ||
| Unauthenticated PHP Object Injection in Valiance <= 1.2 versions. | |||||
| CVE-2026-54194 | 2026-10-26 | N/A | 9.8 CRITICAL | ||
| Contributor PHP Object Injection in Fusion Builder <= 3.15.4 versions. | |||||
| CVE-2026-39443 | 2026-10-26 | N/A | 8.1 HIGH | ||
| Unauthenticated PHP Object Injection in EmallShop <= 2.4.21 versions. | |||||
| CVE-2026-27410 | 2026-10-26 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Deserialization of untrusted data in Slimstat Analytics < 5.4.0 versions. | |||||
| CVE-2026-40756 | 2026-10-26 | N/A | 8.1 HIGH | ||
| Unauthenticated PHP Object Injection in Zoya <= 1.4 versions. | |||||
| CVE-2026-9828 | 2026-10-26 | N/A | N/A | ||
| Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allows Object Injection albeit heavily restricted. More precisely, an attacker able to influence serialized data sent to SimpleSocketServer or SimpleSSLSocketServer can instantiate objects from classes in the java.lang and java.util packages that are not explicitly blocked. Although deserialization is heavily restricted by HardenedObjectInputStream and no practical way to achieve remote code execution or significant privilege escalation has been identified, this issue constitutes a bypass of the intended security restrictions. This issue affects logback: through 1.5.32 inclusive. | |||||
| CVE-2026-39576 | 2026-10-26 | N/A | 8.1 HIGH | ||
| Unauthenticated PHP Object Injection in SingleMalt <= 1.5 versions. | |||||
| CVE-2026-39580 | 2026-10-26 | N/A | 8.1 HIGH | ||
| Unauthenticated PHP Object Injection in Micdrop <= 1.3.1 versions. | |||||
| CVE-2026-39545 | 2026-10-26 | N/A | 8.1 HIGH | ||
| Unauthenticated PHP Object Injection in Zermatt <= 1.6.1 versions. | |||||
| CVE-2026-39554 | 2026-10-26 | N/A | 8.1 HIGH | ||
| Unauthenticated PHP Object Injection in Fidalgo <= 1.2.2 versions. | |||||
| CVE-2026-53805 | 2026-10-26 | N/A | 9.8 CRITICAL | ||
| NVIDIA Spatial Intelligence Lab's (SIL) GEN3C contains an unauthenticated remote code execution vulnerability in the inference API server where the /request-inference and /seed-model endpoints deserialize raw HTTP request bodies using Python's pickle.loads() without authentication or input validation. Attackers can supply a crafted payload containing a __reduce__ gadget to the inference API port to achieve remote code execution as the inference process. | |||||
| CVE-2026-39529 | 2026-10-26 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Elementra <= 1.0.9 versions. | |||||