Total
3246 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-66583 | 2026-08-20 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Forminator <= 1.57.0 versions. | |||||
| CVE-2026-76850 | 2026-08-20 | N/A | 9.8 CRITICAL | ||
| LMDeploy deserializes disaggregated-serving peer messages with pickle. The handle_zmq_recv coroutine in lmdeploy/pytorch/disagg/conn/engine_conn.py reads peer-to-peer cache-free requests with recv_pyobj(), which deserializes the received bytes with pickle.loads(), and the isinstance check against DistServeCacheFreeRequest runs only after deserialization has already completed. The peer that supplies those bytes is caller-controlled: p2p_connect passes remote_engine_endpoint_info.zmq_address from the request body to connect() on the ZMQ PULL socket, and the POST /distserve/p2p_initialize and /distserve/p2p_connect endpoints in lmdeploy/serve/openai/api_server.py apply no authentication unless the server is started with api_keys, which defaults to None. A remote attacker can direct an engine to pull from a ZMQ endpoint under their control and execute arbitrary code in the engine process. Deployments that do not enable disaggregated serving are not affected, because the receive loop is only started once the migration backend accepts the connection. | |||||
| CVE-2026-66672 | 2026-08-20 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Flatastic <= 2.0 versions. | |||||
| CVE-2026-32465 | 2026-08-20 | N/A | 8.8 HIGH | ||
| Customer PHP Object Injection in Essential Real Estate <= 5.3.3 versions. | |||||
| CVE-2026-73341 | 2026-08-20 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in RegistrationMagic <= 6.0.9.7 versions. | |||||
| CVE-2026-73380 | 2026-08-20 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions. | |||||
| CVE-2026-66620 | 2026-08-20 | N/A | 7.2 HIGH | ||
| Editor PHP Object Injection in OptionTree <= 2.7.3 versions. | |||||
| CVE-2026-32470 | 2026-08-20 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions. | |||||
| CVE-2026-73364 | 2026-08-20 | N/A | 9.8 CRITICAL | ||
| Customer PHP Object Injection in Flexible Subscriptions <= 1.8.1 versions. | |||||
| CVE-2026-73376 | 2026-08-20 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions. | |||||
| CVE-2026-73366 | 2026-08-20 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Easy Google Maps <= 1.13.0 versions. | |||||
| CVE-2026-73397 | 2026-08-20 | N/A | 9.8 CRITICAL | ||
| Unauthenticated Deserialization of untrusted data in Youzify <= 1.3.7 versions. | |||||
| CVE-2026-16099 | 2026-08-20 | N/A | 8.8 HIGH | ||
| The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the create_link_item function in all versions up to, and including, 4.5.3. This makes it possible for authenticated attackers, with contributor-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). A viable POP chain exists within the plugin itself via Podlove\ImageCache\GenerationGuard, whose __destruct() method invokes wp_delete_file() with an attacker-controlled file path populated through unserialization. | |||||
| CVE-2024-13784 | 2026-08-20 | N/A | 9.8 CRITICAL | ||
| The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. | |||||
| CVE-2026-10035 | 2026-08-20 | N/A | 6.6 MEDIUM | ||
| The Turnkey bbPress by WeaverTheme plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.1 via deserialization of untrusted input in the wvrbbp_set_to_serialized_values() function (reached through the wvrbbp_save_restore() settings-restore handler). The function reads the raw contents of an administrator-uploaded file and passes them directly to unserialize() without any validation. This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin itself; however, if a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. | |||||
| CVE-2021-26857 | 1 Microsoft | 1 Exchange Server | 2026-08-19 | 6.8 MEDIUM | 7.8 HIGH |
| Microsoft Exchange Server Remote Code Execution Vulnerability | |||||
| CVE-2023-21713 | 1 Microsoft | 1 Sql Server | 2026-08-19 | N/A | 8.8 HIGH |
| Microsoft SQL Server Remote Code Execution Vulnerability | |||||
| CVE-2023-21707 | 1 Microsoft | 1 Exchange Server | 2026-08-19 | N/A | 8.8 HIGH |
| Microsoft Exchange Server Remote Code Execution Vulnerability | |||||
| CVE-2023-21706 | 1 Microsoft | 1 Exchange Server | 2026-08-19 | N/A | 8.8 HIGH |
| Microsoft Exchange Server Remote Code Execution Vulnerability | |||||
| CVE-2023-21703 | 1 Microsoft | 2 Azure Data Box Gateway, Azure Stack Edge | 2026-08-19 | N/A | 6.5 MEDIUM |
| Azure Data Box Gateway Remote Code Execution Vulnerability | |||||