Total
3617 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-49765 | 2026-10-25 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.8 versions. | |||||
| CVE-2026-11857 | 2026-10-25 | N/A | N/A | ||
| Quanos SCHEMA ST4 on-premises contains a local privilege escalation vulnerability in the Client Update Service due to insecure deserialization in the .NET Remoting service. The service is configured with TypeFilterLevel.Full and is bound to local interfaces only through named pipes. A local authenticated attacker can connect to the local named pipe, obtain the .NET Remoting endpoint, and send specially crafted serialized objects. Successful exploitation results in arbitrary code execution in the context of the update process with NT AUTHORITY\SYSTEM privileges. Network-only exploitation is not possible and local host access with an authenticated user session is required. | |||||
| CVE-2026-12787 | 2026-10-25 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A vulnerability was found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0. This affects an unknown part of the component testConnection Endpoint. The manipulation of the argument jdbcUrl results in deserialization. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-56053 | 2026-10-25 | N/A | 8.8 HIGH | ||
| Subscriber PHP Object Injection in EventPrime <= 4.3.4.1 versions. | |||||
| CVE-2026-49781 | 2026-10-25 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in OttoKit <= 1.1.27 versions. | |||||
| CVE-2026-41862 | 1 Broadcom | 1 Spring Statemachine | 2026-10-25 | N/A | 8.8 HIGH |
| Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts without enforcing a class allowlist (CWE-502, deserialisation of untrusted data), which can lead to remote code execution inside the application JVM. Affected versions: Spring Statemachine 4.0.0 through 4.0.1 Spring Statemachine 3.2.0 through 3.2.4 | |||||
| CVE-2026-39474 | 2026-10-25 | N/A | 8.8 HIGH | ||
| Contributor PHP Object Injection in Post Duplicator <= 3.0.10 versions. | |||||
| CVE-2026-54512 | 1 Fasterxml | 1 Jackson-databind | 2026-10-25 | N/A | 8.1 HIGH |
| jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4. | |||||
| CVE-2026-39532 | 2026-10-25 | N/A | 8.8 HIGH | ||
| Contributor PHP Object Injection in Events Calendar for GeoDirectory <= 2.3.25 versions. | |||||
| CVE-2026-49109 | 2026-10-25 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.3 versions. | |||||
| CVE-2026-39478 | 2026-10-25 | N/A | 8.8 HIGH | ||
| Contributor PHP Object Injection in Anti-Malware Security and Brute-Force Firewall <= 4.23.87 versions. | |||||
| CVE-2026-49769 | 2026-10-25 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in wpForo Forum <= 3.1.0 versions. | |||||
| CVE-2026-40044 | 2026-10-25 | N/A | 9.8 CRITICAL | ||
| Pachno 1.0.6 contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting malicious serialized objects into cache files. Attackers can write PHP object payloads to world-writable cache files with predictable names in the cache directory, which are unserialized during framework bootstrap before authentication checks occur. | |||||
| CVE-2026-49085 | 2026-10-25 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 versions. | |||||
| CVE-2026-49763 | 2026-10-25 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Integration for Contact Form 7 HubSpot <= 1.3.7 versions. | |||||
| CVE-2026-49106 | 2026-10-25 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Integration for Contact Form 7 and Constant Contact <= 1.1.6 versions. | |||||
| CVE-2026-10748 | 1 Sonatype | 1 Nexus Repository Manager | 2026-10-25 | N/A | 7.2 HIGH |
| An authenticated user with the nx-licensing-create privilege can upload a specially crafted license file to execute arbitrary operating system commands as the Nexus process user in Sonatype Nexus Repository 3 versions before 3.92.0. | |||||
| CVE-2026-39498 | 2026-10-25 | N/A | 7.2 HIGH | ||
| Shop manager PHP Object Injection in YayMail <= 4.3.3 versions. | |||||
| CVE-2026-39481 | 2026-10-25 | N/A | 7.2 HIGH | ||
| Author PHP Object Injection in Modula Image Gallery <= 2.14.18 versions. | |||||
| CVE-2026-10043 | 2026-10-25 | N/A | 7.8 HIGH | ||
| MosaicML Composer Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MosaicML Composer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of checkpoints. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27990. | |||||