Total
3616 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-87692 | 1 Microsoft | 2 Exchange Server, Exchange Server Subscription Edition | 2026-10-29 | N/A | 7.8 HIGH |
| Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-62017 | 2026-10-29 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions. | |||||
| CVE-2026-62012 | 2026-10-29 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions. | |||||
| CVE-2026-62006 | 2026-10-29 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Nuts <= 1.12 versions. | |||||
| CVE-2026-62001 | 2026-10-29 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions. | |||||
| CVE-2026-57845 | 2026-10-29 | N/A | 8.8 HIGH | ||
| Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Attackers can supply a pickle-backed dataset that is processed by Pandas._generate_tables via pandas.read_pickle() without validation, so when a victim calls datasets.load_dataset("pandas", data_files=...), the embedded __reduce__ payload executes code with the victim process's privileges. | |||||
| CVE-2026-54858 | 2026-10-29 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions. | |||||
| CVE-2026-118080 | 2026-10-29 | N/A | 8.8 HIGH | ||
| Contributor PHP Object Injection in Social Snap <= 1.5.4 versions. | |||||
| CVE-2026-118075 | 2026-10-29 | N/A | 8.8 HIGH | ||
| Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions. | |||||
| CVE-2026-116867 | 2026-10-29 | N/A | 8.8 HIGH | ||
| Contributor PHP Object Injection in Dynamic QR Code – generator <= 1.0.1 versions. | |||||
| CVE-2026-116098 | 1 Steelraven7 | 1 Ravenfield | 2026-10-29 | 7.5 HIGH | 6.3 MEDIUM |
| A vulnerability was detected in SteelRaven7 Ravenfield 25407073. This vulnerability affects the function cacheCoverPoints of the component RFL Custom Map Handler/RFLD Custom Map Handler. Performing a manipulation results in deserialization. Remote exploitation of the attack is possible. The patch is named EA39 Security Patch. Applying a patch is the recommended action to fix this issue. | |||||
| CVE-2026-119120 | 2026-10-29 | N/A | 7.5 HIGH | ||
| Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request bodies, allowing authenticated clients to choose which HuggingFace model the server loads. Attackers can reference a malicious repository with a pickle weight file to execute Python code under PyTorch below 2.6, or exhaust disk and memory. | |||||
| CVE-2026-118617 | 2026-10-29 | N/A | 7.8 HIGH | ||
| Ultralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the load_dataset_cache_file function. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30124. | |||||
| CVE-2026-118613 | 2026-10-29 | N/A | 7.8 HIGH | ||
| Ultralytics torch_load Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the torch_load function. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-29652. | |||||
| CVE-2026-103693 | 2026-10-29 | N/A | 9.0 CRITICAL | ||
| The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an unauthenticated user from storing a serialized PHP object in user metadata that is deserialized when a public profile is viewed, allowing PHP object injection that can lead to arbitrary file write and potential remote code execution. | |||||
| CVE-2026-114724 | 1 Roundcube | 1 Webmail | 2026-10-29 | N/A | 7.4 HIGH |
| Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize(). A session key prefixed with “!” was treated as having no value, and the reconstructed serialized string was emitted with a key but no corresponding value, desynchronizing the remainder of the input so that following session data was interpreted as a serialized value. This yields a PHP object injection primitive for an attacker able to influence stored session data. Upstream fixed this in the commit “Fix object injection primitive in rcube_session::unserialize() via “!”-prefixed session keys”, which rejects such keys. | |||||
| CVE-2026-116392 | 2026-10-29 | N/A | 7.2 HIGH | ||
| Deserialization of Untrusted Data vulnerability in PickPlugins Accordion accordions allows Object Injection.This issue affects Accordion: from n/a through 2.3.25. | |||||
| CVE-2026-116391 | 2026-10-29 | N/A | 8.8 HIGH | ||
| Deserialization of Untrusted Data vulnerability in GS Plugins GS Logo Slider gs-logo-slider allows Object Injection.This issue affects GS Logo Slider: from n/a through 3.8.9. | |||||
| CVE-2026-116390 | 2026-10-29 | N/A | 7.2 HIGH | ||
| Deserialization of Untrusted Data vulnerability in stepasyuk Filter Everything — WordPress & WooCommerce Filters filter-everything allows Object Injection.This issue affects Filter Everything — WordPress & WooCommerce Filters: from n/a through 1.9.7. | |||||
| CVE-2026-116389 | 2026-10-29 | N/A | 8.8 HIGH | ||
| Deserialization of Untrusted Data vulnerability in crossi72 Phoenix Media Rename phoenix-media-rename allows Object Injection.This issue affects Phoenix Media Rename: from n/a through 3.13.5. | |||||