CVE-2026-78529: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Alliance = 3.11 versions...

CVE-2026-66563: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Windsor = 2.10 versions...

CVE-2026-93942: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell allows Object Injection.This issue affects Dwell: from n/a through 1.16.0...

CVE-2026-93929: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ThemeREX Group Travesia travesia allows Object Injection.This issue affects Travesia: from n/a through 1.1.16...

CVE-2026-62021: Deserialization of Untrusted Data

Subscriber PHP Object Injection in Angio = 1.1.1 versions...

CVE-2026-62045: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers booklovers allows Object Injection.This issue affects Booklovers: from n/a through 2.13.0...

PT-2026-109572

Name of the Vulnerable Software and Affected Versions Gutentype versions prior to 2.1.13 Description Deserialization of untrusted data in the Gutentype plugin allows Object Injection. Object Injection occurs when untrusted data is used to abuse the logic of an application to execute arbitrary cod...

CVE-2026-105885: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in 10Web Slider by 10Web slider-wd allows Object Injection.This issue affects Slider by 10Web: from n/a through 1.2.62...

CVE-2026-103365: Exposure of Sensitive Information to an Unauthorized Actor

The Bookly – Online Scheduling and Appointment Booking System plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 28.4 via the classic booking form's Details step. The endpoint booklyrenderdetails is registered for both wpajax and wpajaxnopriv, t...

CVE-2026-108639: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to permanently delete data dictionaries via the deletePhysic handler of SysDictController. Low-privileged attackers can send DELETE requests to /sys/dict/deletePhysic/id to irreversibly remov...

PT-2026-109781

Name of the Vulnerable Software and Affected Versions Booster for WooCommerce versions prior to 8.4.1 Description An unauthenticated PHP Object Injection issue exists, which occurs due to the deserialization of untrusted data. This allows an attacker to inject malicious PHP objects into the...

PT-2026-109576

Name of the Vulnerable Software and Affected Versions Smash versions prior to 1.12.0 Description ThemeREX Group Smash is subject to a deserialization of untrusted data issue that allows Object Injection. Object Injection occurs when untrusted data is used to abuse the logic of an application by...

PT-2026-109582

Name of the Vulnerable Software and Affected Versions Hygia versions prior to 1.21.0 Description Deserialization of untrusted data in the software allows Object Injection, a technique where an attacker can manipulate serialized objects to execute arbitrary code or interfere with application logic...

CVE-2026-108579: Improper Neutralization of Formula Elements in a CSV File

OpenPanel through 2.3.0 contains a CSV formula injection vulnerability that allows unauthenticated attackers to embed spreadsheet formulas by supplying crafted profile IDs to the /track endpoint. Attackers can send tracking events with profile IDs like =HYPERLINK... matching a cohort, so exported...

PT-2026-109588

Deserialization of Untrusted Data vulnerability in ThemeREX Group Camelia camelia allows Object Injection.This issue affects Camelia: from n/a through 1.2.15...

PT-2026-109851

Name of the Vulnerable Software and Affected Versions ShiftCV versions prior to 3.0.15 Description An unauthenticated PHP Object Injection issue exists, which occurs due to the deserialization of untrusted data. This allows an attacker to inject malicious PHP objects into the application...

PT-2026-109900

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw allows authenticated users to permanently delete data dictionaries. Low-privileged attackers can send DELETE requests to the '/sys/dict/deletePhysic/id' endpoint, which trigge...

PT-2026-109821

Name of the Vulnerable Software and Affected Versions Avala versions prior to 1.1.5 Description An unauthenticated PHP Object Injection issue exists, which occurs due to the deserialization of untrusted data. This allows an attacker to inject malicious PHP objects into the application...

PT-2026-109842

Name of the Vulnerable Software and Affected Versions Asia Garden versions 1.3.1 and earlier Description An unauthenticated PHP Object Injection issue exists, which occurs due to the deserialization of untrusted data. This allows an attacker to inject malicious PHP objects into the application...

PT-2026-109807

Name of the Vulnerable Software and Affected Versions Stargaze versions 1.10 and earlier Description An unauthenticated PHP Object Injection issue exists, which occurs due to the deserialization of untrusted data. This allows an attacker to inject malicious PHP objects into the application...