PT-2026-103244

Unauthenticated PHP Object Injection in Booking Activities = 1.18.7.1 versions...

PT-2026-103488

Contributor PHP Object Injection in Photo Gallery by 10Web = 1.8.46 versions...

PT-2026-103184

Contributor PHP Object Injection in DesignSetGo = 2.8.0 versions...

PT-2026-103158

Shop manager PHP Object Injection in Music Player for WooCommerce = 1.9.1 versions...

CVE-2026-95531: Deserialization of Untrusted Data

Subscriber PHP Object Injection in Conversational Forms for ChatBot = 1.5.0 versions...

CVE-2026-94677: Deserialization of Untrusted Data

Shop manager PHP Object Injection in Kadence WooCommerce Email Designer = 1.5.19.1 versions...

PT-2026-103181

Shop manager PHP Object Injection in Kadence WooCommerce Email Designer = 1.5.19.1 versions...

CVE-2026-91051: Deserialization of Untrusted Data

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote co...

PT-2026-103217

Editor PHP Object Injection in Ultimate Addons for Contact Form 7 = 3.5.51 versions...

CVE-2026-96833: Deserialization of Untrusted Data

Editor PHP Object Injection in Ultimate Addons for Contact Form 7 = 3.5.51 versions...

PT-2026-103170

Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer = 2.33.6 versions...

PT-2026-103215

Contributor PHP Object Injection in Themify Builder = 7.8.1 versions...

PT-2026-103189

Custom role PHP Object Injection in eCommerce Product Catalog = 3.6.0 versions...

CVE-2026-96343: Deserialization of Untrusted Data

Custom role PHP Object Injection in WP ERP = 1.17.9 versions...

PT-2026-103188

Custom role PHP Object Injection in WP ERP = 1.17.9 versions...

CVE-2026-96344: Deserialization of Untrusted Data

Custom role PHP Object Injection in eCommerce Product Catalog = 3.6.0 versions...

Relapse-Exploit

PS5 Relapse Exploit Supported firmware: 7.00 through 13.60...

exploit

PS5 Relapse Exploit Supported firmware: 7.00 through 13.60...

CVE-2026-100722

A flaw was found in vm2. An attacker who can execute untrusted code within the sandbox can trigger an unhandled error by instantiating host-provided functions that return a rejected asynchronous operation Promise. Due to missing error handling in the sandbox-to-host object construction trap, the...

WordPress Music Player for WooCommerce plugin <= 1.9.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Music Player for WooCommerce versions = 1.9.1...