WordPress Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress plugin <= 2.0.13 - Authenticated (Administrator+) PHP Object Injection vulnerability

Authenticated Administrator+ PHP Object Injection vulnerability discovered by Duc Long in WordPress Plugin Counter Box versions = 2.0.13...

PT-2026-50102

Unauthenticated PHP Object Injection in Fidalgo = 1.2.2 versions...

Anywhere, Any-Stymie: Remote Activation of Trojan Malware on LiDAR with Modulated Signals

LiDAR sensors are widely deployed in autonomous systems for 3D perception and safety-critical decision-making. We identify a previously unexplored attack surface in which dormant malware embedded in the LiDAR sensing pipeline remains inactive during normal operation and can be externally triggere...

PT-2026-50106

Unauthenticated PHP Object Injection in Playroom = 1.4.1 versions...

PT-2026-50098

Unauthenticated PHP Object Injection in Alloggio - Hotel Booking = 2.1.2 versions...

PT-2026-50117

Unauthenticated PHP Object Injection in Behold = 1.5 versions...

PT-2026-50110

Unauthenticated PHP Object Injection in Laurits = 1.5.1 versions...

PT-2026-50127

Name of the Vulnerable Software and Affected Versions Fusion Builder versions prior to 3.15.5 Description A PHP Object Injection issue exists in the software. This occurs when an application deserializes untrusted data, allowing an attacker to manipulate the objects created and potentially execut...

PT-2026-50088

Name of the Vulnerable Software and Affected Versions Nifty versions 1.4.1 and earlier Description Unauthenticated PHP Object Injection allows an attacker to inject malicious objects into the application. PHP Object Injection occurs when user-supplied input is passed to the unserialize function...

PT-2026-50112

Unauthenticated PHP Object Injection in Ashtanga = 1.2 versions...

PT-2026-50085

Contributor PHP Object Injection in Avada = 3.15.3 versions...

PT-2026-50114

Unauthenticated PHP Object Injection in TechLink = 1.3 versions...

PT-2026-50113

Unauthenticated PHP Object Injection in Roisin = 1.4 versions...

PT-2026-50095

Unauthenticated PHP Object Injection in Kapee 1.7.0 versions...

PT-2026-50108

Unauthenticated PHP Object Injection in Micdrop = 1.3.1 versions...

PT-2026-50118

Unauthenticated PHP Object Injection in Valeska = 1.2.2 versions...

PT-2026-50097

Unauthenticated PHP Object Injection in Elementra = 1.0.9 versions...

PT-2026-50111

Unauthenticated PHP Object Injection in LuxeDrive = 1.4 versions...

PT-2026-50081

Unauthenticated PHP Object Injection in SeaFood Company = 1.4 versions...

EUVD-2026-36908

Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms = 1.1.1 versions...