Export limit exceeded: 17022 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (3683 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-118079 | 2026-10-30 | 7.2 High | ||
| Shop manager PHP Object Injection in FV Flowplayer Video Player <= 8.3.4 versions. | ||||
| CVE-2026-118078 | 2026-10-30 | 7.2 High | ||
| Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions. | ||||
| CVE-2026-118077 | 2026-10-30 | 7.2 High | ||
| Author PHP Object Injection in Sastra Essential Addons for Elementor <= 1.2.3 versions. | ||||
| CVE-2026-118074 | 2026-10-30 | 7.2 High | ||
| Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions. | ||||
| CVE-2026-118073 | 2026-10-30 | 8.8 High | ||
| Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions. | ||||
| CVE-2026-116869 | 2026-10-30 | 7.2 High | ||
| Shop manager PHP Object Injection in myPOS Checkout <= 1.4.5 versions. | ||||
| CVE-2026-116866 | 2026-10-30 | 8.8 High | ||
| Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce <= 4.4.0 versions. | ||||
| CVE-2026-116865 | 2026-10-30 | 7.2 High | ||
| Editor PHP Object Injection in Zippy <= 1.7.0 versions. | ||||
| CVE-2026-116864 | 2026-10-30 | 7.2 High | ||
| Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions. | ||||
| CVE-2026-61803 | 1 Frappe | 1 Lms | 2026-10-30 | N/A |
| Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.1, the `course/certificate checkout` flow accepts client-controlled pricing, allowing an authenticated user to complete a paid-course or certificate purchase for an amount other than the actual price. This is a business-logic integrity issue; it does not expose other users' data or grant elevated privileges. This issue is fixed in version 2.52.1. | ||||
| CVE-2026-119526 | 2026-10-30 | 9.8 Critical | ||
| Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection. This issue affects Royal Event: from n/a through 2.0. | ||||
| CVE-2026-90888 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions. | ||||
| CVE-2026-104324 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-10-30 | 8.8 High |
| IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to deserialization of untrusted data. | ||||
| CVE-2026-104317 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-10-30 | 8.1 High |
| IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message broker to execute arbitrary code on the system due to the deserialization of untrusted data. | ||||
| CVE-2026-59396 | 1 Cloudfoundry | 2 Cf-deployment, Uaa | 2026-10-30 | 4.9 Medium |
| A denial-of-service vulnerability exists in UAA's private_key_jwt client-authentication mechanism. When UAA retrieves a remote JWKS URI, it caches the response. Invalid authentication attempts can trigger full deserialization of this cached data. An attacker with prerequisites (write access to clients or a compromised endpoint) can send anonymous requests that force repeated parsing of large cached objects, causing excessive CPU usage and potential Java heap exhaustion via OutOfMemoryError, resulting in service unavailability. | ||||
| CVE-2026-45145 | 1 Chamilo | 1 Chamilo Lms | 2026-10-30 | 7.5 High |
| Chamilo LMS is an open-source learning management system. Prior to 2.0.1, `public/main/inc/lib/career.lib.php` and `public/main/cron/import_csv.php` call PHP's native `unserialize()` on `user_career.extra_data` retrieved from the database without the `allowed_classes: false` safety option. An attacker able to write crafted serialized PHP objects to that column, for example through a separate SQL injection, a compromised admin CSV import, or a lower-privilege admin panel, can instantiate arbitrary PHP objects and trigger POP gadget chains in autoloaded `Symfony`, `Doctrine`, or `Monolog` components. This permits arbitrary OS commands as the web server user, compromising server confidentiality, integrity, and availability. This issue is fixed in version 2.0.1. | ||||
| CVE-2026-119706 | 1 Internlm | 1 Lmdeploy | 2026-10-30 | 9.8 Critical |
| InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /update_weights endpoint. Attackers can submit a base64-encoded crafted pickle in serialized_named_tensors, which ForkingPickler.loads deserializes without validation, executing commands as the api_server process. | ||||
| CVE-2026-114422 | 1 Wordpress-extensions | 1 Enable Media Replace | 2026-10-30 | 7.5 High |
| The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when a user with upload access performs a routine media replacement, resulting in PHP Object Injection and local file inclusion of existing PHP/HTML files, which can be escalated to remote code execution where an attacker-influenced PHP or HTML file is present on the server. This is a regression of CVE-2023-4643, which was fixed in 4.1.3 and reintroduced in 4.1.4. | ||||
| CVE-2026-62018 | 2026-10-29 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions. | ||||
| CVE-2026-62008 | 2026-10-29 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions. | ||||