CVE-2026-94678: Deserialization of Untrusted Data

Contributor PHP Object Injection in Go Live Update Urls = 7.0.8 versions...

PT-2026-103244

Unauthenticated PHP Object Injection in Booking Activities = 1.18.7.1 versions...

CVE-2026-103229: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects the function mysqliquery of the file admin/delete1.php of the component Unauthenticated Action Script. Performing a manipulation of the argument ID results i...

CVE-2026-102427: Unrestricted Upload of File with Dangerous Type

Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing task=getContent, a task with no authentication or ACL check anywhere in the dispatch chain. The handler validates th...

CVE-2026-97248: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Booking Activities = 1.18.7.1 versions...

CVE-2026-97246: Deserialization of Untrusted Data

Subscriber PHP Object Injection in ShortPixel Image Optimizer = 6.5.5 versions...

CVE-2026-96344: Deserialization of Untrusted Data

Custom role PHP Object Injection in eCommerce Product Catalog = 3.6.0 versions...

CVE-2026-96343: Deserialization of Untrusted Data

Custom role PHP Object Injection in WP ERP = 1.17.9 versions...

CVE-2026-94683: Deserialization of Untrusted Data

Contributor PHP Object Injection in DesignSetGo = 2.8.0 versions...

CVE-2026-94076: Deserialization of Untrusted Data

Contributor PHP Object Injection in SEO Plugin by Squirrly SEO = 14.2.5 versions...

CVE-2026-93771: Deserialization of Untrusted Data

Shop manager PHP Object Injection in Cost of Goods for WooCommerce = 3.5.2 versions...

CVE-2026-93624: Deserialization of Untrusted Data

Shop manager PHP Object Injection in Music Player for WooCommerce = 1.9.1 versions...

CVE-2026-93651: Deserialization of Untrusted Data

Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce = 2.1.2 versions...

CVE-2026-91051: Deserialization of Untrusted Data

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote co...

CVE-2026-100512: Deserialization of Untrusted Data

Contributor PHP Object Injection in Nested Pages = 3.3.2 versions...

PT-2026-103328

Name of the Vulnerable Software and Affected Versions OrdaSoft Joomla CCK versions prior to 8.3.16 Description An unauthenticated remote code execution issue exists in the site/uploader.php endpoint, which is accessible via the getContent task. The system fails to perform authentication or Access...

PT-2026-103488

Contributor PHP Object Injection in Photo Gallery by 10Web = 1.8.46 versions...

PT-2026-103242

Subscriber PHP Object Injection in ShortPixel Image Optimizer = 6.5.5 versions...

CentOS Linux 7 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-devel / etc (CENTOS7:CLSA-2024:1729628764)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2024:1729628764 advisory. - In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3. before 8.3.12, HTTPREDIRECTSTATUS variable is used to check whether or not CGI...

CentOS Linux 6 [TuxCare] Security Update: cups / cups-devel / cups-libs / cups-lpd / cups-php (CENTOS6:CLSA-2026:1785399587)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1785399587 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900...