CVE-2025-60205: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ThemeREX Group ThemeREX Addons trxaddons allows Object Injection.This issue affects ThemeREX Addons: from n/a through 2.36.1.1...

WordPress Theme: joly: CVE-2025-58953: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

Unauthenticated Local File Inclusion in Joly = 1.22.0 versions...

WordPress Theme: neuronet: CVE-2025-58952: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

Unauthenticated Local File Inclusion in Neuronet 1.14.0 versions...

CVE-2026-39557: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in NeoBeat = 1.7 versions...

PT-2026-50409

Unauthenticated PHP Object Injection in Moderno 1.43 versions...

CVE-2026-27429: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Nifty = 1.4.1 versions...

CVE-2026-49075: Deserialization of Untrusted Data

Contributor PHP Object Injection in JetEngine = 3.8.9.1 versions...

WordPress Theme: homeroofer: CVE-2025-58954: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

Unauthenticated Local File Inclusion in HomeRoofer = 2.11.0 versions...

CVE-2026-12115: Deserialization of Untrusted Data

The Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.13 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level...

CVE-2026-48820: Improper Control of Filename for Include/Require Statement in PHP Program

CakePHP is a rapid development framework for PHP. In versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 through 5.1.6, 5.2.0 through 5.2.12, and 5.3.0 through 5.3.5, View::getElementFileName does not check that the resolved element path is within the application/plugin view template paths...

CVE-2026-40759: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Esmée = 1.4 versions...

PT-2026-50400

Unauthenticated PHP Object Injection in Hiroshi = 1.5.1 versions...

CVE-2025-69158: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Granola = 1.13 versions...

Drupal core - Critical - PHP object injection - SA-CORE-2026-005

SA-CORE-2019-003 added protection for fields that store serialized data to disallow direct writes via web services. The above fix did not cover all potential attack vectors for JSON:API. An attacker with appropriate JSON:API write permission could potentially inject a malicious payload in certain...

Formatter Field - Critical - PHP object injection - SA-CONTRIB-2026-048

The Formatter Field module provides a mechanism for specifying a formatter and formatter settings to be used for displaying a field, on a per-entity basis. formatterfield stores some data as PHP-serialized strings. In some situations, malicious data can be written directly to the field. This can...

CVE-2026-39576: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in SingleMalt = 1.5 versions...

PT-2026-50544

Name of the Vulnerable Software and Affected Versions PHP Standard Library PSL versions 6.1.0 through 6.1.1 PHP Standard Library PSL version 6.2.0 Description The PslH2ServerConnection function does not validate that the total bytes received in DATA frames match the content-length header declared...

CVE-2025-69162: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Grecko = 5.17 versions...

CVE-2026-39443: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in EmallShop = 2.4.21 versions...

GHSA-F59H-Q822-G45G Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`

Summary forwardauth copyheaders deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through phpfastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with . This lets a client send an underscor...