Total
3617 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-77645 | 2026-10-26 | N/A | N/A | ||
| A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. | |||||
| CVE-2026-77646 | 2026-10-26 | N/A | N/A | ||
| A Server-Side Request Forgery (SSRF) vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. | |||||
| CVE-2026-18285 | 2026-10-26 | N/A | 7.8 HIGH | ||
| Aeon load_rehab_pile_dataset Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Aeon. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the load_rehab_pile_dataset method. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28749. | |||||
| CVE-2026-32192 | 1 Microsoft | 1 Azure Monitor Agent | 2026-10-26 | N/A | 7.8 HIGH |
| Deserialization of untrusted data in Azure Monitor Agent allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-54806 | 2026-10-26 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in WP Activity Log <= 5.6.3.1 versions. | |||||
| CVE-2026-39557 | 2026-10-26 | N/A | 8.1 HIGH | ||
| Unauthenticated PHP Object Injection in NeoBeat <= 1.7 versions. | |||||
| CVE-2026-40751 | 2026-10-26 | N/A | 8.1 HIGH | ||
| Unauthenticated PHP Object Injection in Ashtanga <= 1.2 versions. | |||||
| CVE-2026-40735 | 2026-10-26 | N/A | 8.1 HIGH | ||
| Unauthenticated PHP Object Injection in Reina <= 2.1 versions. | |||||
| CVE-2026-39567 | 2026-10-26 | N/A | 8.1 HIGH | ||
| Unauthenticated PHP Object Injection in Santé <= 1.5.1 versions. | |||||
| CVE-2026-40754 | 2026-10-26 | N/A | 8.1 HIGH | ||
| Unauthenticated PHP Object Injection in Roisin <= 1.4 versions. | |||||
| CVE-2026-40753 | 2026-10-26 | N/A | 8.1 HIGH | ||
| Unauthenticated PHP Object Injection in EasyMeals <= 1.5.1 versions. | |||||
| CVE-2026-12046 | 1 Pgadmin | 1 Pgadmin 4 | 2026-10-25 | N/A | 9.0 CRITICAL |
| Two state-mutating endpoints in pgAdmin 4's SQL Editor blueprint -- DELETE /sqleditor/close/<trans_id> and POST /sqleditor/initialize/sqleditor/update_connection/<sgid>/<sid>/<did> -- were the only routes in the module missing the @pga_login_required decorator. Both reach a pickle.loads sink on session['gridData'][<trans_id>]['command_obj']: the close endpoint via close_sqleditor_session(), and update_sqleditor_connection via check_transaction_status(). In server mode these endpoints were reachable without any authenticated pgAdmin session. The defect is a missing-authentication-on-critical-function (CWE-306) wrapper around a deserialization-of-untrusted-data sink (CWE-502). Exploiting it for remote code execution requires the attacker to also forge a server-side session file whose gridData entry contains a malicious pickle payload, which in turn requires both (a) knowledge of pgAdmin's Flask SECRET_KEY (no chain to leak it is described here -- the attacker must already possess it) and (b) write access to pgAdmin's sessions/ directory on the host. Neither precondition is granted by this defect on its own. When those preconditions are met from another channel (misconfigured deployment, prior compromise, leaked configuration), the missing auth gate is the final hop that turns an existing partial compromise into unauthenticated code execution in the pgAdmin process -- and, by extension, on the host under whatever account runs pgAdmin. Fix is a one-line @pga_login_required decorator on each of the two endpoints, matching the convention used by every other route in the module. The is_authenticated / MFA chain now runs before the trans_id is dereferenced, so an unauthenticated request is rejected before reaching the deserialization path. The defect is server-mode only. In DESKTOP mode pgAdmin's before_request hook re-authenticates DESKTOP_USER on every request, so no endpoint can be exercised in an unauthenticated state and no auth decorator (or its absence) is meaningful. The accompanying regression test mirrors the attacker's path -- harvests an X-pgA-CSRFToken from GET /login and replays it against both endpoints -- and self-skips outside server mode for that reason; it is wired into the existing server-mode CI workflow alongside the data-isolation tests. This issue affects pgAdmin 4: from 6.9 before 9.16. | |||||
| CVE-2026-48853 | 2026-10-25 | N/A | N/A | ||
| Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc allow unauthenticated attackers to crash the BEAM node via atom table exhaustion and, when a decoded term flows into a call site that invokes it, achieve remote code execution on the server. 'Elixir.GRPC.Codec.Erlpack':decode/2 (lib/grpc/codec/erlpack.ex) calls :erlang.binary_to_term/1 on the raw gRPC message body without the :safe option, no size bound, and no type guard. Any unauthenticated peer that sends a request with Content-Type: application/grpc+erlpack can send a crafted payload that mints arbitrary new atoms (which are never garbage-collected, exhausting the bounded atom table and crashing the VM) or that encodes a fun term which, if applied anywhere downstream, executes attacker-controlled code inside the server process. This issue affects grpc: from 0.4.0 before 1.0.0. | |||||
| CVE-2026-49105 | 2026-10-25 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 versions. | |||||
| CVE-2026-39471 | 2026-10-25 | N/A | 7.2 HIGH | ||
| Author PHP Object Injection in ShortPixel Image Optimizer <= 6.4.3 versions. | |||||
| CVE-2026-39499 | 2026-10-25 | N/A | 7.2 HIGH | ||
| Shop manager PHP Object Injection in Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.19 versions. | |||||
| CVE-2026-24228 | 1 Nvidia | 1 Nemo | 2026-10-25 | N/A | 7.8 HIGH |
| NVIDIA NeMo Framework for Linux contains a vulnerability where an attacker may cause deserialization of untrusted data. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, data tampering, and information disclosure. | |||||
| CVE-2026-9691 | 2026-10-25 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 versions. | |||||
| CVE-2026-49104 | 2026-10-25 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.2.1 versions. | |||||
| CVE-2026-48909 | 2026-10-25 | N/A | N/A | ||
| SP LMS (com_splms) < 4.1.4 by JoomShaper deserializes user-controlled cookie data without validation, enabling an unauthenticated remote attacker to execute arbitrary code on the server. | |||||