Total
3616 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-116869 | 2026-10-30 | N/A | 7.2 HIGH | ||
| Shop manager PHP Object Injection in myPOS Checkout <= 1.4.5 versions. | |||||
| CVE-2026-116866 | 2026-10-30 | N/A | 8.8 HIGH | ||
| Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce <= 4.4.0 versions. | |||||
| CVE-2026-116865 | 2026-10-30 | N/A | 7.2 HIGH | ||
| Editor PHP Object Injection in Zippy <= 1.7.0 versions. | |||||
| CVE-2026-116864 | 2026-10-30 | N/A | 7.2 HIGH | ||
| Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions. | |||||
| CVE-2026-104324 | 1 Langflow | 1 Langflow | 2026-10-30 | N/A | 8.8 HIGH |
| IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to deserialization of untrusted data. | |||||
| CVE-2026-104317 | 1 Langflow | 1 Langflow | 2026-10-30 | N/A | 8.1 HIGH |
| IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message broker to execute arbitrary code on the system due to the deserialization of untrusted data. | |||||
| CVE-2026-114422 | 2026-10-30 | N/A | 7.5 HIGH | ||
| The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when a user with upload access performs a routine media replacement, resulting in PHP Object Injection and local file inclusion of existing PHP/HTML files, which can be escalated to remote code execution where an attacker-influenced PHP or HTML file is present on the server. This is a regression of CVE-2023-4643, which was fixed in 4.1.3 and reintroduced in 4.1.4. | |||||
| CVE-2026-15555 | 2026-10-30 | N/A | 8.8 HIGH | ||
| A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node. | |||||
| CVE-2026-45145 | 2026-10-30 | N/A | 7.5 HIGH | ||
| Chamilo LMS is an open-source learning management system. Prior to 2.0.1, `public/main/inc/lib/career.lib.php` and `public/main/cron/import_csv.php` call PHP's native `unserialize()` on `user_career.extra_data` retrieved from the database without the `allowed_classes: false` safety option. An attacker able to write crafted serialized PHP objects to that column, for example through a separate SQL injection, a compromised admin CSV import, or a lower-privilege admin panel, can instantiate arbitrary PHP objects and trigger POP gadget chains in autoloaded `Symfony`, `Doctrine`, or `Monolog` components. This permits arbitrary OS commands as the web server user, compromising server confidentiality, integrity, and availability. This issue is fixed in version 2.0.1. | |||||
| CVE-2026-119706 | 2026-10-30 | N/A | 9.8 CRITICAL | ||
| InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /update_weights endpoint. Attackers can submit a base64-encoded crafted pickle in serialized_named_tensors, which ForkingPickler.loads deserializes without validation, executing commands as the api_server process. | |||||
| CVE-2026-103039 | 2026-10-30 | N/A | 9.8 CRITICAL | ||
| The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List. This is due to GFFormsModel::create_post() passing the submitted value to WordPress' unrestricted global maybe_unserialize() rather than the plugin's own hardened GFCommon::maybe_unserialize(), which was added in 3.1.1 and passes allowed_classes => false precisely to prevent object instantiation. Where the field has a content template enabled, the submitted row reaches that call verbatim. This makes it possible for unauthenticated attackers to inject a PHP object into post meta. No PHP Object Injection gadget chain is present in the plugin itself; however, if a gadget chain is present via an additional plugin or theme, it could allow the attacker to perform actions such as remote code execution. Where the custom field is mapped to the protected _wp_page_template meta key, WordPress itself supplies the chain: validate_file() accepts non-scalars, WP_Theme::__toString() then resolves an attacker-controlled path, and on hosts with a readable PEAR install and register_argc_argv enabled this yields remote code execution. | |||||
| CVE-2025-25034 | 2026-10-29 | N/A | N/A | ||
| A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to improper validation of PHP serialized input in the SugarRestSerialize.php script. The vulnerable code fails to sanitize the rest_data parameter before passing it to the unserialize() function. This allows an unauthenticated attacker to submit crafted serialized data containing malicious object declarations, resulting in arbitrary code execution within the application context. Although SugarCRM released a prior fix in advisory sugarcrm-sa-2016-001, the patch was incomplete and failed to address some vectors. Exploitation evidence was observed by the Shadowserver Foundation on 2024-09-13 UTC. | |||||
| CVE-2026-62018 | 2026-10-29 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions. | |||||
| CVE-2026-62013 | 2026-10-29 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions. | |||||
| CVE-2026-62008 | 2026-10-29 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions. | |||||
| CVE-2026-62002 | 2026-10-29 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions. | |||||
| CVE-2026-54859 | 2026-10-29 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Preservation <= 1.15 versions. | |||||
| CVE-2026-118081 | 2026-10-29 | N/A | 8.8 HIGH | ||
| Contributor PHP Object Injection in 10Web Social Photo Feed <= 1.5.6 versions. | |||||
| CVE-2026-118076 | 2026-10-29 | N/A | 8.8 HIGH | ||
| Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions. | |||||
| CVE-2026-116868 | 2026-10-29 | N/A | 8.8 HIGH | ||
| Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types <= 1.3.1 versions. | |||||