Total
3618 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-69130 | 2026-10-06 | N/A | 8.8 HIGH | ||
| Deserialization of Untrusted Data vulnerability in Pixel Makers Creative INC. Entrepreneur - Booking for Small Businesses WordPress Theme allows Object Injection. This issue affects Entrepreneur - Booking for Small Businesses WordPress Theme: from n/a before 3.1.5. | |||||
| CVE-2025-60230 | 2026-10-06 | N/A | 9.8 CRITICAL | ||
| Deserialization of Untrusted Data vulnerability in Themeton The Barber Shop allows Object Injection. This issue affects The Barber Shop: from n/a through 1.9. | |||||
| CVE-2025-60236 | 2026-10-06 | N/A | 9.8 CRITICAL | ||
| Deserialization of Untrusted Data vulnerability in EMV Creatify allows Object Injection. This issue affects Creatify: from n/a through 1.5. | |||||
| CVE-2025-60231 | 2026-10-06 | N/A | 9.8 CRITICAL | ||
| Deserialization of Untrusted Data vulnerability in EMV The Hospital nrghospital allows Object Injection. This issue affects The Hospital: from n/a through 1.8.1. | |||||
| CVE-2025-69108 | 2026-10-06 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Hot Coffee <= 1.7 versions. | |||||
| CVE-2025-69122 | 2026-10-06 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in SeaFood Company <= 1.4 versions. | |||||
| CVE-2025-69127 | 2026-10-06 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Plumbing <= 1.6 versions. | |||||
| CVE-2025-69111 | 2026-10-06 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Reisen <= 1.4.1 versions. | |||||
| CVE-2025-60229 | 2026-10-06 | N/A | 9.8 CRITICAL | ||
| Deserialization of Untrusted Data vulnerability in Themeton Lagom allows Object Injection. This issue affects Lagom: from n/a through 2.0. | |||||
| CVE-2025-27511 | 1 Osgeo | 1 Geoserver | 2026-10-06 | N/A | 7.2 HIGH |
| GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.27.0 of the GeoServer DB2 DataStore Extension, an administrator can perform a JNDI attack through specially crafted DB2 jdbc url leading to to Remote Code Execution (RCE). Version 2.27.0 fixes the issue. | |||||
| CVE-2026-18163 | 2 Ibm, Redhat | 2 Financial Transaction Manager, Openshift | 2026-10-06 | N/A | 9.8 CRITICAL |
| IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper deserialization of untrusted data. | |||||
| CVE-2019-25777 | 2026-10-06 | N/A | 7.3 HIGH | ||
| YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution. A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or YAML's own load options. A perl/glob document that sets $YAML::LoadCode or $YAML::UseCode turns on code loading, which is off by default, for every later Load() in the process. A perl/code document is then passed to a string eval, so an attacker who supplies two documents to separate Load() calls in one process can execute arbitrary Perl code. | |||||
| CVE-2017-20285 | 2026-10-06 | N/A | 9.1 CRITICAL | ||
| YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of scope. What DESTROY does depends on the classes the process has loaded. With File::Temp::Dir from core Perl, it can delete a directory tree the document names. | |||||
| CVE-2026-37719 | 2026-10-06 | N/A | 9.8 CRITICAL | ||
| An issue in dormakaba evolo Service (all versions) allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component. | |||||
| CVE-2026-82093 | 1 Ibm | 1 Datastage On Cloud Pak For Data | 2026-10-06 | N/A | 8.8 HIGH |
| IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to unsafe deserialization of untrusted data. | |||||
| CVE-2026-104905 | 2026-10-06 | N/A | 8.1 HIGH | ||
| FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData() that allows authenticated attackers to trigger unserialize() on raw POST data without an allowed_classes filter for multiple-select fields. Attackers can submit a serialized XLSXWriter object as the field value to invoke its __destruct() method, deleting arbitrary attacker-specified files such as config.php or backup data, resulting in denial of service and potential application reinstall hijack. | |||||
| CVE-2026-103831 | 2026-10-06 | N/A | N/A | ||
| CVE-2026-103831: Insecure deserialization vulnerability in the Psr16CacheAdapter component of the TrueLayer Magento 2 Plugin, due to the use of PHP's native unserialize() function without restrictions on the classes allowed when retrieving data stored in the cache. An attacker who already has the ability to write manipulated data to the cache backend used by Magento—such as Redis or Memcached—could inject specially crafted PHP objects and trigger their deserialization, potentially leading to arbitrary code execution via gadget strings available in the application environment. Exploitation therefore requires a prerequisite condition that allows writing to the cache infrastructure, either through access to the local file system or to a cache infrastructure accessible from the Magento environment. | |||||
| CVE-2026-39797 | 2026-10-06 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in GDPR Framework By Data443 <= 2.5.0 versions. | |||||
| CVE-2026-93617 | 2026-10-06 | N/A | 7.2 HIGH | ||
| Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Object Injection.This issue affects Sunshine Photo Cart: from n/a through 3.7.1. | |||||
| CVE-2026-100511 | 2026-10-06 | N/A | 8.8 HIGH | ||
| Deserialization of Untrusted Data vulnerability in Vektor Inc. VK Google Job Posting Manager vk-google-job-posting-manager allows Object Injection.This issue affects VK Google Job Posting Manager: from n/a through 1.3.1. | |||||