2026

Unauthenticated PHP Object Injection in AI Lab < 5.4.2 versions.

Unauthenticated Privilege Escalation in LoginPress Pro <= 6.2.2 versions.

Contributor PHP Object Injection in JetEngine <= 3.8.9.1 versions.

Unauthenticated PHP Object Injection in Thrive Apprentice < 10.8.10.2 versions.

Unauthenticated Broken Authentication in wpForo Forum <= 3.1.0 versions.

Unauthenticated PHP Object Injection in JetEngine <= 3.8.10 versions.

Contributor PHP Object Injection in Fusion Builder <= 3.15.4 versions.

Subscriber Privilege Escalation in SMS Alert Order Notifications <= 3.9.4 versions.

Unauthenticated PHP Object Injection in WP Activity Log <= 5.6.3.1 versions.

Unauthenticated Privilege Escalation in Registration Form for WooCommerce <= 1.0.9 versions.

Deserialization of Untrusted Data vulnerability in Themeton Lagom allows Object Injection. This issue affects Lagom: fr

Deserialization of Untrusted Data vulnerability in Themeton The Barber Shop allows Object Injection. This issue affects

Deserialization of Untrusted Data vulnerability in EMV The Hospital nrghospital allows Object Injection. This issue aff

Deserialization of Untrusted Data vulnerability in EMV Creatify allows Object Injection. This issue affects Creatify: f

Unauthenticated PHP Object Injection in Reisen <= 1.4.1 versions.

Unauthenticated PHP Object Injection in Plumbing <= 1.6 versions.

Unauthenticated PHP Object Injection in Moderno < 1.43 versions.

Python StateMachine versions 3.0.0 before 3.2.0 contains a remote code execution vulnerability that allows attackers to

picklescan before 0.0.33 contains an incomplete deny-list that fails to block pydoc.locate and operator.methodcaller fun

picklescan before 0.0.33 contains an arbitrary file writing vulnerability that allows attackers to bypass the dangerous

picklescan before 0.0.33 fails to block the ctypes module, allowing attackers to achieve remote code execution by invoki

picklescan before 0.0.27 contains a parsing logic error in the _list_globals function when handling STACK_GLOBAL opcodes

picklescan before 1.0.4 contains an incomplete blocklist for the profile module that fails to block the module-level pro

picklescan before 1.0.1 contains an unsafe deserialization vulnerability allowing unauthenticated users to execute arbit

NVIDIA Spatial Intelligence Lab's (SIL) GEN3C contains an unauthenticated remote code execution vulnerability in the inf

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vul

Nur-Alam39 bus-ticket (no released versions; latest commit 459cabdbeb99c00225b26e46e3c2c30ae1de7bad) contains an unauthe

claudiopizzillo PIAF-HMS (PBX-In-A-Flash Hotel Management System; no released versions, latest commit 389d2633441b65ced1

A remote, unauthenticated attacker may exploit a deserialization of untrusted data vulnerability in ibaPDA or ibaDatCoor

In Eclipse 4diac FORTE versions 3.0.0 to 3.1.0, a specially crafted DELETE connection command to the management interfac

InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a co

InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a co

InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a co

InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a co

The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contrac

JTL Shop versions 5.2.0 through 5.7.1 contains a server-side template injection vulnerability that allows unauthenticate

Bitnami Cassandra container images are affected by a retained default superuser vulnerability. When a custom administrat

Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disclose information ove

Improper input validation in AVer PTC500S, PTC115, PTC500+, and PTC115+ cameras may allow a remote, unauthenticated att

FileRise before 3.16.0 is vulnerable to path traversal in the shared-folder upload endpoint (/api/folder/uploadToSharedF

The BetterDocs Pro plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 3.8.0 vi

In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 account

Tenda AC7 v15.03.06.44 contains a stack buffer overflow vulnerability in the /goform/AdvSetMacMtuWan interface via the w

Tenda AC7 v15.03.06.44 contains a stack buffer overflow vulnerability in the /goform/AdvSetMacMtuWan interface via the c

Tenda AC7 v15.03.06.44 contains a stack buffer overflow vulnerability in the /goform/AdvSetMacMtuWan interface via the m

In Tenda AC7 v15.03.06.44, the wanSpeed parameter of the route /goform/AdvSetMacMtuWan has a stack buffer overflow vulne

ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. Versions 2.0.18 through 3.0.8 have a pre-authenticat

The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and in

A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulti

A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature