CVE-2026-10196 Mail Mint <= 1.31.0 - Unauthenticated PHP Object Injection in Arbitrary Form Fields

The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.31.0 via deserialization of untrusted input in the 'handleformsubmission' function. This makes it possible for...

EUVD-2026-71991

The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.31.0 via deserialization of untrusted input in the 'handleformsubmission' function. This makes it possible for...

CVE-2026-10196 Mail Mint <= 1.31.0 - Unauthenticated PHP Object Injection in Arbitrary Form Fields

The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.31.0 via deserialization of untrusted input in the 'handleformsubmission' function. This makes it possible for...

CVE-2026-10196

The Mail Mint WordPress plugin (Email Marketing, Newsletter, Email Automation & WooCommerce Emails) is affected by an unauthenticated PHP Object Injection in all versions up to and including 1.31.0 . The root cause is deserialization of untrusted input in the handle_form_submission function, whic...

CVE-2026-19887

The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback uscesactionactingtransaction. Unauthenticated attackers can store arbitrary 'reserve' key/value...

CVE-2026-19887 Welcart e-Commerce <= 2.12.1 - Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback

The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback uscesactionactingtransaction. Unauthenticated attackers can store arbitrary 'reserve' key/value...

PT-2026-86327

Name of the Vulnerable Software and Affected Versions Welcart e-Commerce plugin for WordPress versions prior to 2.12.2 Description PHP Object Injection occurs due to the deserialization of untrusted input within the Telecom EDY payment callback usces action acting transaction. Unauthenticated...

PT-2026-86406

Name of the Vulnerable Software and Affected Versions Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails versions prior to 1.31.1 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input within the handle form submission...

GHSA-GCX9-497G-6CP6 vulnerabilities

Vulnerabilities for packages: thingsboard...

CVE-2026-61686

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the DataGrid LiveComponent deserializes a context prop value using PHP's unserialize after receiving it from the client. Because the prop is marked writable: true, an authenticated attacker can supply an arbitrary PHP...

EUVD-2026-71621

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the DataGrid LiveComponent deserializes a context prop value using PHP's unserialize after receiving it from the client. Because the prop is marked writable: true, an authenticated attacker can supply an arbitrary PHP...

CVE-2026-61686 SolidInvoice: PHP unserialize() called on client-controlled data in DataGrid LiveComponent context prop

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the DataGrid LiveComponent deserializes a context prop value using PHP's unserialize after receiving it from the client. Because the prop is marked writable: true, an authenticated attacker can supply an arbitrary PHP...

CVE-2026-61686 SolidInvoice: PHP unserialize() called on client-controlled data in DataGrid LiveComponent context prop

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the DataGrid LiveComponent deserializes a context prop value using PHP's unserialize after receiving it from the client. Because the prop is marked writable: true, an authenticated attacker can supply an arbitrary PHP...

CVE-2026-61686 SolidInvoice: PHP unserialize() called on client-controlled data in DataGrid LiveComponent context prop

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the DataGrid LiveComponent deserializes a context prop value using PHP's unserialize after receiving it from the client. Because the prop is marked writable: true, an authenticated attacker can supply an arbitrary PHP...

Security Bulletin: Watson Machine Learning on Cloud Pak for Data is affected by transformers(Publicly disclosed vulnerability) ( CVE-2024-11393, CVE-2024-11394, CVE-2024-11392, CVE-2024-12720, CVE-2024-3568)

Summary Watson Machine Learning on Cloud Pak for Data is affected by CVE-2024-11393, CVE-2024-11394, CVE-2024-11392, CVE-2024-12720, CVE-2024-3568 Vulnerability Details CVEID:CVE-2024-11393 DESCRIPTION: Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code...

Exploit for Deserialization of Untrusted Data in Jetbrains Teamcity

CVE-2026-63077 — JetBrains TeamCity Unauthenticated RCE !Py...

Mirth-Connect-CVE-2023-43208

CVE-2023-43208: Unauthenticated Remote Code Execution RCE in NextGen Mirth Connect This exploit leverages a critical deserialization vulnerability within Mirth Connect's XStream engine. It stems from an incomplete patch for CVE-2023-37679, enabling unauthenticated arbitrary code execution across...

Unsafe Deserialization

Spring for GraphQL is vulnerable to Unsafe Deserialization. The vulnerability is due to unsafe deserialization of paginated GraphQL query data, where crafted serialized objects can be supplied and deserialized without proper validation, allowing attackers to execute arbitrary code...

Metabase - H2 Deserialization RCE (CVE-2026-59827)

Exploits CVE-2026-59827 by authenticating to Metabase, locating an H2 database including the default sample DB, and submitting a native query that deserializes a Clojure PriorityQueue gadget chain via SELECT CASTX'...' AS OTHER. Command execution is blind — output is not returned over HTTP...

EUVD-2026-70789

MOOS core-moos through 10.4.0 contains a buffer over-read vulnerability in CMOOSCommPkt where a four-byte packet triggers out-of-bounds memory access during deserialization. Attackers can open a TCP connection to the MOOSDB port and send a crafted short packet to read memory before authentication...