Total
3617 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-27333 | 2026-10-25 | N/A | 8.1 HIGH | ||
| Unauthenticated Deserialization of untrusted data in Paid Videochat Turnkey Site <= 7.3.23 versions. | |||||
| CVE-2026-35300 | 1 Oracle | 1 Weblogic Server | 2026-10-25 | N/A | 9.8 CRITICAL |
| Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise WebLogic Server. Successful attacks of this vulnerability can result in takeover of WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). | |||||
| CVE-2026-49286 | 2026-10-25 | N/A | 8.1 HIGH | ||
| PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `pontedilana/php-weasyprint` guarded the output filename against the `phar://` stream wrapper with a case-sensitive blacklist. PHP stream wrappers are case-insensitive, so `PHAR://`, `Phar://`, etc. bypass the check and reach `fileExists()` (`file_exists()`) in `prepareOutput()`. On PHP 7 (which the library still supports — PHP 7.4+), this triggers deserialization of a crafted PHAR archive's metadata, leading to remote code execution. This is the patch-bypass of CVE-2023-28115. The same issue and fix were handled upstream in KnpLabs/snappy (GHSA-92rv-4j2h-8mjj). PhpWeasyPrint version 2.6.0 contains a patch for the issue. | |||||
| CVE-2026-27053 | 2026-10-25 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Broadcast Live Video < 7.1.3 versions. | |||||
| CVE-2026-45034 | 2026-10-25 | N/A | N/A | ||
| PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.5, CVE-2026-34084 was patched by the helper File::prohibitWrappers. The helper calls parse_url($filename, PHP_URL_SCHEME) and then checks is_string($scheme) && strlen($scheme) > 1 to reject stream wrappers such as phar://, php://, data:// or expect://. The check is not equivalent to "does the path contain a wrapper". When the input has the form phar:///path/file.phar/inner with three or more slashes after the scheme, parse_url returns boolean false instead of returning the scheme string. The is_string($scheme) branch is therefore skipped, the helper returns without throwing, and the caller proceeds. PHP's stream layer, however, still treats phar:///... as a valid phar wrapper and opens the underlying phar file. The result is that IOFactory::load($attackerPath) walks past the patch and still touches the phar wrapper. On PHP 7.x, simply reaching the phar wrapper via is_file is enough for PHP to automatically deserialize the phar metadata, which in turn invokes the magic methods __wakeup and __destruct of an attacker controlled object and gives full RCE. On PHP 8.x, automatic metadata deserialization for plain file ops was removed, so the chain at the PhpSpreadsheet layer reduces to a phar wrapper file read primitive, and RCE only resurfaces if the downstream consumer ever calls Phar::getMetadata. This vulnerability is fixed in 1.30.5. | |||||
| CVE-2026-39434 | 2026-10-25 | N/A | 7.2 HIGH | ||
| Shop manager PHP Object Injection in CTX Feed <= 6.6.26 versions. | |||||
| CVE-2026-40738 | 2026-10-25 | N/A | 8.1 HIGH | ||
| Unauthenticated PHP Object Injection in Eldon <= 1.4.1 versions. | |||||
| CVE-2026-39253 | 2026-10-25 | N/A | 8.1 HIGH | ||
| An issue in Pivotal CRM v.6.6.04.08 allows a remote attacker to execute arbitrary code via the Pivotal.Core.Common.dll and Pivotal.Engine.Client.Services.Conversion.dll components. | |||||
| CVE-2026-53914 | 1 Jetbrains | 1 Kotlin | 2026-10-25 | N/A | 6.7 MEDIUM |
| In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata | |||||
| CVE-2026-56121 | 2026-10-25 | N/A | 9.8 CRITICAL | ||
| Feast before 0.63.0 contains an unsafe deserialization vulnerability that allows unauthenticated or unauthorized attackers to achieve remote code execution by sending a crafted gRPC request to the registry server. The user_defined_function.body field of an OnDemandFeatureView spec is decoded from base64 and passed to dill.loads() before any authorization check is performed, enabling attackers to embed a malicious serialized Python object with an arbitrary __reduce__ method to execute OS commands as the feast service account. | |||||
| CVE-2026-46607 | 2026-10-25 | N/A | 7.8 HIGH | ||
| Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, glances/outdated.py uses pickle.load() to read a version-check cache file stored at a predictable, world-accessible path (~/.cache/glances/glances-version.db or $XDG_CACHE_HOME/glances/glances-version.db). No integrity check, signature verification, or format validation is performed before deserialization. An attacker with write access to that path — through any of several realistic local or container-level scenarios — can plant a malicious pickle file and achieve arbitrary code execution as the OS user running Glances the next time it starts with version checking enabled (the default). This vulnerability is fixed in 4.5.5. | |||||
| CVE-2026-27414 | 2026-10-25 | N/A | 8.8 HIGH | ||
| Contributor PHP Object Injection in Werkstatt <= 4.8.3 versions. | |||||
| CVE-2026-7871 | 1 Langflow | 1 Langflow | 2026-10-25 | N/A | 9.8 CRITICAL |
| IBM Langflow OSS 1.0.0 through 1.10.0 allows users with Redis access to execute arbitrary code with full application privileges, compromising all secrets, data, and system integrity. | |||||
| CVE-2026-13759 | 1 Ibm | 1 Websphere Extreme Scale | 2026-10-25 | N/A | 7.5 HIGH |
| IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 ships three ObjectInputStream subclasses (WsObjectInputStream, ObjectStreamPool$ReusableInputStream, ObjectInputStreamResolver) that install no JEP-290 class filter; when Coherence is on the classpath, multiple RCE gadget chains including RemoteConstructor.readResolve and PriorityQueue/ExtractorComparator are confirmed working, allowing a post-login attacker who can write a session attribute or a LAN-adjacent attacker on the grid replication wire to execute arbitrary code on peer WAS JVMs | |||||
| CVE-2026-56037 | 2026-10-25 | N/A | 8.8 HIGH | ||
| Deserialization of Untrusted Data vulnerability in Themify Themify Popup allows Object Injection. This issue affects Themify Popup: from n/a through 1.4.3. | |||||
| CVE-2026-57677 | 2026-10-25 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Novalnet Payment Gateway for WooCommerce <= 12.10.3 versions. | |||||
| CVE-2026-27060 | 2026-10-25 | N/A | 8.8 HIGH | ||
| Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember Premium allows Object Injection. This issue affects ARMember Premium: from n/a before 7.6. | |||||
| CVE-2026-13371 | 1 Watchguard | 39 Firebox Cloud, Firebox M270, Firebox M290 and 36 more | 2026-10-25 | N/A | 4.9 MEDIUM |
| An authenticated administrator can trigger a denial-of-service condition in the Fireware Management Web UI by sending malformed or crafted data to the put_data endpoint, which performs unsafe deserialization of the attacker-supplied input. | |||||
| CVE-2026-57621 | 2026-10-25 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Booktics <= 1.0.21 versions. | |||||
| CVE-2026-12578 | 2026-10-25 | N/A | N/A | ||
| The affected product is vulnerable to a deserialization of untrusted data, which may allow an attacker to execute arbitrary code. | |||||