CVE-2026-63639 Valkey: UAF in stream deserialization may lead to remote code execution

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when...

CVE-2026-63639 Valkey: UAF in stream deserialization may lead to remote code execution

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when...

CVE-2026-63639

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when...

CVE-2026-63639

Valkey (distributed key-value DB) has a use-after-free in the RESTORE command's RDB stream consumer-group deserialization: a malformed payload assigns one Pending Entry List NACK to multiple consumers, and deleting one while another references it can lead to remote code execution (CVSS 8.8 HIGH, ...

CVE-2026-48586 affecting package influxdb for versions less than 2.7.5-20

CVE-2026-48586 affecting package influxdb for versions less than 2.7.5-20. A patched version of the package is available...

CVE-2026-73397

Youzify plugin versions up to 1.3.7 suffer from unauthenticated deserialization of untrusted data, scored CVSS 9.8 (critical) with network access, no privileges, and full CIA impact. Upgrade beyond 1.3.7 or disable the plugin; no exploit code is provided in the documents.

CVE-2026-73397

Unauthenticated Deserialization of untrusted data in Youzify = 1.3.7 versions...

CVE-2026-73397 WordPress Youzify plugin <= 1.3.7 - Deserialization of untrusted data vulnerability

Unauthenticated Deserialization of untrusted data in Youzify = 1.3.7 versions...

CVE-2026-73397 WordPress Youzify plugin <= 1.3.7 - Deserialization of untrusted data vulnerability

Unauthenticated Deserialization of untrusted data in Youzify = 1.3.7 versions...

EUVD-2026-60803

Unauthenticated Deserialization of untrusted data in Youzify = 1.3.7 versions...

EUVD-2026-60795

Unauthenticated PHP Object Injection in Popup by Supsystic = 1.13.0 versions...

CVE-2026-73380 WordPress Popup by Supsystic plugin <= 1.13.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Popup by Supsystic = 1.13.0 versions...

EUVD-2026-60788

Unauthenticated PHP Object Injection in Easy Google Maps = 1.13.0 versions...

CVE-2026-73341

Unauthenticated PHP Object Injection in RegistrationMagic = 6.0.9.7 versions...

CVE-2026-66620 WordPress OptionTree plugin <= 2.7.3 - PHP Object Injection vulnerability

Editor PHP Object Injection in OptionTree = 2.7.3 versions...

CVE-2026-66620 WordPress OptionTree plugin <= 2.7.3 - PHP Object Injection vulnerability

Editor PHP Object Injection in OptionTree = 2.7.3 versions...

CVE-2026-66620

The WordPress OptionTree plugin (≤ 2.7.3) is vulnerable to PHP Object Injection via its Editor component. CVSS 7.2 (HIGH) reflects network attack vector, low complexity, and high impact across confidentiality, integrity, and availability, requiring attacker privileges. Exploitation details are no...

CVE-2026-32465 WordPress Essential Real Estate plugin <= 5.3.3 - PHP Object Injection vulnerability

Customer PHP Object Injection in Essential Real Estate = 5.3.3 versions...

USN-8642-1: c3p0 vulnerabilities

It was discovered that c3p0 was vulnerable to remote code execution via maliciously crafted serialized objects and JNDI references. An attacker could use this to execute arbitrary code, bypass security restrictions, or cause a denial of service...

USN-8642-1 c3p0 vulnerabilities

It was discovered that c3p0 was vulnerable to remote code execution via maliciously crafted serialized objects and JNDI references. An attacker could use this to execute arbitrary code, bypass security restrictions, or cause a denial of service...