Total
3617 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-27380 | 2026-10-23 | N/A | 7.2 HIGH | ||
| Editor PHP Object Injection in Car Rental Manager <= 1.3.9 versions. | |||||
| CVE-2026-12350 | 1 Ibm | 2 Mq Operator, Supplied Mq Advanced Container Images | 2026-10-23 | N/A | 6.5 MEDIUM |
| IBM MQ could allow an authenticated attacker to cause a denial of service by sending a specially crafted asynchronous consume request that crashes the queue manager agent process. | |||||
| CVE-2026-112853 | 2026-10-23 | N/A | 9.8 CRITICAL | ||
| Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue affects Hallelujah: from n/a through 1.1.1. | |||||
| CVE-2026-112862 | 2026-10-23 | N/A | 9.8 CRITICAL | ||
| Deserialization of Untrusted Data vulnerability in xnau webdesign Participants Database participants-database allows Object Injection.This issue affects Participants Database: from n/a through 2.7.8.5. | |||||
| CVE-2026-112857 | 2026-10-23 | N/A | 9.8 CRITICAL | ||
| Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This issue affects Reprizo: from n/a through 1.0.8. | |||||
| CVE-2026-87697 | 2026-10-22 | N/A | 8.8 HIGH | ||
| Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-83520 | 2026-10-22 | N/A | 8.8 HIGH | ||
| Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-70035 | 2026-10-22 | N/A | 8.8 HIGH | ||
| Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-73341 | 2026-10-22 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in RegistrationMagic <= 6.0.9.7 versions. | |||||
| CVE-2026-74012 | 2026-10-22 | N/A | 8.8 HIGH | ||
| Deserialization of Untrusted Data vulnerability in TaxoPress allows Object Injection. This issue affects TaxoPress: from n/a through 3.51.0. | |||||
| CVE-2026-73380 | 2026-10-22 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions. | |||||
| CVE-2026-66620 | 2026-10-22 | N/A | 7.2 HIGH | ||
| Editor PHP Object Injection in OptionTree <= 2.7.3 versions. | |||||
| CVE-2026-32470 | 2026-10-22 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions. | |||||
| CVE-2026-32465 | 2026-10-22 | N/A | 8.8 HIGH | ||
| Customer PHP Object Injection in Essential Real Estate <= 5.3.3 versions. | |||||
| CVE-2026-59940 | 2026-10-22 | N/A | 9.8 CRITICAL | ||
| Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON() allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine internal Promise resolver records, causing deserialization side effects with plugins enabled and potentially unintended server-side invocation or remote code execution when downstream frameworks register callable wrappers. This issue is fixed in version 1.5.3. | |||||
| CVE-2026-73366 | 2026-10-22 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Easy Google Maps <= 1.13.0 versions. | |||||
| CVE-2026-73397 | 2026-10-22 | N/A | 9.8 CRITICAL | ||
| Unauthenticated Deserialization of untrusted data in Youzify <= 1.3.7 versions. | |||||
| CVE-2026-60412 | 1 Oracle | 1 Outside In Technology | 2026-10-22 | N/A | 7.8 HIGH |
| Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). | |||||
| CVE-2026-60392 | 1 Oracle | 1 Outside In Technology | 2026-10-22 | N/A | 7.8 HIGH |
| Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In PDF Export SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). | |||||
| CVE-2026-82814 | 2026-10-22 | N/A | 8.8 HIGH | ||
| The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.5.17 and 4.6.10, respectively, via deserialization of untrusted database content in DUPX_UpdateEngine::unserializeTest() during migration. This allows unauthenticated attackers to store a serialized object in public site content before an administrator builds a package and later performs a migration or import that runs database search-and-replace. Duplicator Free bundles a Requests 1.7 POP chain that permits attacker-selected callbacks, resulting in direct operating-system command execution. Duplicator Pro bundles an IndexList destructor gadget that permits deletion of an attacker-selected existing file when its containing directory is writable by the installer PHP process; deletion of wp-config.php can expose the setup wizard and lead to site takeover and code execution if the attacker reaches it first and supplies a reachable database they control. The package must be created after the carrier is stored, and a later administrator migration action is required. | |||||