11262 matches found
CVE-2026-39443: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in EmallShop = 2.4.21 versions...
CVE-2026-40761: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Valeska = 1.2.2 versions...
PT-2026-50302
Unauthenticated PHP Object Injection in Zermatt = 1.6.1 versions...
PT-2026-50398
Unauthenticated PHP Object Injection in Konsept = 1.9 versions...
CVE-2026-40735: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Reina = 2.1 versions...
CVE-2026-40751: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Ashtanga = 1.2 versions...
CVE-2026-40753: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in EasyMeals = 1.5.1 versions...
CVE-2026-39529: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Elementra = 1.0.9 versions...
Drupal core - Critical - PHP object injection - SA-CORE-2026-005
SA-CORE-2019-003 added protection for fields that store serialized data to disallow direct writes via web services. The above fix did not cover all potential attack vectors for JSON:API. An attacker with appropriate JSON:API write permission could potentially inject a malicious payload in certain...
Flag attendance field - Critical - PHP object injection - SA-CONTRIB-2026-049
The Flag attendance field module gives you the ability to add attendance by depending on Flag module. flagattendancefield stores some data as PHP-serialized strings. In some situations, malicious data can be written directly to the field. This can lead to an object injection vulnerability when th...
PT-2026-50316
Unauthenticated PHP Object Injection in Reina = 2.1 versions...
PT-2026-50405
Unauthenticated PHP Object Injection in Eldon = 1.4.1 versions...
CVE-2026-40738: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Eldon = 1.4.1 versions...
CVE-2026-39445: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Alukas 3.0.0 versions...
CVE-2026-39554: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Fidalgo = 1.2.2 versions...
CVE-2026-39446: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Kapee 1.7.0 versions...
CVE-2025-69127: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Plumbing = 1.6 versions...
PT-2026-50401
Unauthenticated PHP Object Injection in SingleMalt = 1.5 versions...