Total
3618 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-97257 | 2026-10-06 | N/A | 8.8 HIGH | ||
| Deserialization of Untrusted Data vulnerability in PressTigers Simple Event Planner simple-event-planner allows Object Injection.This issue affects Simple Event Planner: from n/a through 1.5.7. | |||||
| CVE-2026-103348 | 2026-10-06 | N/A | 7.2 HIGH | ||
| Deserialization of Untrusted Data vulnerability in Smackcoders Inc. WP Ultimate Exporter wp-ultimate-exporter allows Object Injection.This issue affects WP Ultimate Exporter: from n/a through 3.0. | |||||
| CVE-2026-103349 | 2026-10-06 | N/A | 7.2 HIGH | ||
| Deserialization of Untrusted Data vulnerability in Rymera Web Co Product Feed PRO for WooCommerce woo-product-feed-pro allows Object Injection.This issue affects Product Feed PRO for WooCommerce: from n/a through 13.5.7. | |||||
| CVE-2026-104747 | 2026-10-06 | N/A | 8.1 HIGH | ||
| Unauthenticated PHP Object Injection in Haaken <= 1.5 versions. | |||||
| CVE-2026-100506 | 2026-10-06 | N/A | 7.2 HIGH | ||
| Deserialization of Untrusted Data vulnerability in WP Spell Check WP Spell Check wp-spell-check allows Object Injection.This issue affects WP Spell Check: from n/a through 12.1. | |||||
| CVE-2026-97283 | 2026-10-06 | N/A | 9.8 CRITICAL | ||
| Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Object Injection.This issue affects Advanced Post Manager: from n/a through 4.5.5. | |||||
| CVE-2026-82988 | 2026-10-06 | N/A | 7.5 HIGH | ||
| There exists an arbitrary file download in vCast APK delivery mechanism in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to trigger unprivileged APK installation via serving a malicious APK URL through an unauthenticated download endpoint | |||||
| CVE-2026-81657 | 1 Ibm | 1 Guardium Data Protection | 2026-10-06 | N/A | 9.8 CRITICAL |
| IBM Guardium Data Protection 12.2 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data. | |||||
| CVE-2026-81784 | 2026-10-06 | N/A | 8.1 HIGH | ||
| Deserialization of Untrusted Data vulnerability in Marcin Wise Chat wise-chat allows Object Injection.This issue affects Wise Chat: from n/a through 3.4.2. | |||||
| CVE-2025-64233 | 2026-10-05 | N/A | 9.8 CRITICAL | ||
| Deserialization of Untrusted Data vulnerability in BoldThemes Codiqa codiqa allows Object Injection.This issue affects Codiqa: from n/a through < 1.2.8. | |||||
| CVE-2025-6544 | 1 H2o | 1 H2o | 2026-10-05 | N/A | 9.8 CRITICAL |
| A deserialization vulnerability exists in h2oai/h2o-3 versions <= 3.46.0.8, allowing attackers to read arbitrary system files and execute arbitrary code. The vulnerability arises from improper handling of JDBC connection parameters, which can be exploited by bypassing regular expression checks and using double URL encoding. This issue impacts all users of the affected versions. | |||||
| CVE-2025-60083 | 2026-10-05 | N/A | 8.8 HIGH | ||
| Deserialization of Untrusted Data vulnerability in add-ons.org PDF Invoice Builder for WooCommerce pdf-for-woocommerce allows Object Injection.This issue affects PDF Invoice Builder for WooCommerce: from n/a through <= 6.5.0. | |||||
| CVE-2025-64227 | 2026-10-05 | N/A | 9.8 CRITICAL | ||
| Deserialization of Untrusted Data vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Object Injection.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.7. | |||||
| CVE-2026-55083 | 2026-10-02 | N/A | 9.1 CRITICAL | ||
| DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. From versions 2.42.0 to before 2.42.5.1, and from versions 2.43.0 to before 2.43.0.1, DHIS2 is vulnerable to remote code execution (RCE) via unsafe Java deserialization. This issue has been patched in versions 2.42.5.1, 2.43.0.1, and 2.44. | |||||
| CVE-2026-47297 | 1 Microsoft | 3 Sql Server 2019, Sql Server 2022, Sql Server 2025 | 2026-10-02 | N/A | 8.1 HIGH |
| Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2024-13784 | 2026-10-01 | N/A | 9.8 CRITICAL | ||
| The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. | |||||
| CVE-2026-97284 | 2026-10-01 | N/A | 8.8 HIGH | ||
| Contributor PHP Object Injection in Icegram <= 3.1.31 versions. | |||||
| CVE-2026-94390 | 2026-10-01 | N/A | 7.2 HIGH | ||
| Editor PHP Object Injection in Hide Shipping Method For WooCommerce <= 1.5.4 versions. | |||||
| CVE-2026-58163 | 1 Apache | 1 Traffic Server | 2026-10-01 | N/A | 7.5 HIGH |
| Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue. | |||||
| CVE-2025-53303 | 2026-09-30 | N/A | 8.8 HIGH | ||
| Deserialization of Untrusted Data vulnerability in ThemeMove ThemeMove Core thememove-core allows Object Injection.This issue affects ThemeMove Core: from n/a through <= 1.4.2. | |||||