CVE-2026-62120: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Law Office = 3.20 versions...

CVE-2026-62087: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Equadio = 1.1.4 versions...

CVE-2026-62090: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in WineShop = 3.20 versions...

CVE-2026-62086: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Juno = 2.25 versions...

CVE-2026-62077: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Avala = 1.1.4 versions...

CVE-2026-62076: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Kalles = 1.1.7.1 versions...

CVE-2026-62054: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Yacht Rental = 2.6 versions...

CVE-2026-62053: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Wine House = 3.20 versions...

CVE-2026-62052: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Tipsy = 1.6 versions...

CVE-2026-62051: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Stargaze = 1.10 versions...

CVE-2026-62050: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Splendour = 1.23 versions...

CVE-2026-62021: Deserialization of Untrusted Data

Subscriber PHP Object Injection in Angio = 1.1.1 versions...

CVE-2026-42723: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in CleanSkin = 1.5.0 versions...

CVE-2026-42718: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Booster for WooCommerce = 8.4.0 versions...

CVE-2026-42716: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway = 4.8.2 versions...

CVE-2026-104899: Improper Control of Filename for Include/Require Statement in PHP Program

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.187 via the 'designtype' parameter parameter. This makes it possible for unauthenticated attackers to include and...

CVE-2026-104723: Deserialization of Untrusted Data

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 10.2.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with custom-level access and above, ...

Linux Distros Unpatched Vulnerability : CVE-2026-106436

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an...

CVE-2026-12626: Deserialization of Untrusted Data

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 28.2 via deserialization of untrusted input via the ‘value’ parameter. This makes it possible for authenticated attackers, with custom-lev...

Linux Distros Unpatched Vulnerability : CVE-2026-106432

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4...