111942 matches found
CVE-2026-49075: Deserialization of Untrusted Data
Contributor PHP Object Injection in JetEngine = 3.8.9.1 versions...
CVE-2026-54814: Improper Control of Filename for Include/Require Statement in PHP Program
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in StylemixThemes Motors allows PHP Local File Inclusion. This issue affects Motors: from n/a through 1.4.109...
CVE-2026-40735: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Reina = 2.1 versions...
CVE-2026-40751: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Ashtanga = 1.2 versions...
CVE-2026-40753: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in EasyMeals = 1.5.1 versions...
CVE-2026-42380: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in AI Lab 5.4.2 versions...
CVE-2026-40725: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in WooCommerce Product Filters 2.0.6 versions...
PT-2026-50396
Unauthenticated PHP Object Injection in Alukas 3.0.0 versions...
CVE-2026-40759: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Esmée = 1.4 versions...
WordPress Theme: homeroofer: CVE-2025-58954: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Unauthenticated Local File Inclusion in HomeRoofer = 2.11.0 versions...
CVE-2026-40739: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in LuxeDrive = 1.4 versions...
CVE-2026-12115: Deserialization of Untrusted Data
The Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.13 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level...
CVE-2026-39573: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Mildhill = 1.5 versions...
CVE-2026-52706: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in JetEngine = 3.8.10 versions...
CVE-2026-40736: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Laurits = 1.5.1 versions...
GHSA-F59H-Q822-G45G Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`
Summary forwardauth copyheaders deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through phpfastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with . This lets a client send an underscor...
CVE-2026-40761 WordPress Valeska theme <= 1.2.2 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Valeska = 1.2.2 versions...
CVE-2026-40761
WordPress Theme Valeska <= 1.2.2 is affected by an unauthenticated PHP Object Injection vulnerability. Affected component: Valeska theme (WordPress). Root cause: PHP object injection in versions
