WordPress AI ANN theme <= 1.29.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme AI ANN versions = 1.29.0...

WordPress Agricola theme <= 1.21.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Bonds in WordPress Theme Agricola versions = 1.21.0...

WordPress Agora theme <= 1.9 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Bonds in WordPress Theme Agora versions = 1.9...

WordPress Advice theme <= 1.18.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Bonds in WordPress Theme Advice versions = 1.18.0...

WordPress Adrena theme <= 1.2.14 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Bonds in WordPress Theme Adrena versions = 1.2.14...

WordPress Accalia theme <= 1.5.3 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Accalia versions = 1.5.3...

WordPress Abogado theme <= 1.18 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Bonds in WordPress Theme Abogado versions = 1.18...

WordPress Abelle theme <= 1.22 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Abelle versions = 1.22...

WordPress A.Williams theme <= 1.3.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Bonds in WordPress Theme A.Williams versions = 1.3.1...

WordPress 69 Clothing theme <= 1.2.11.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Bonds in WordPress Theme 69 Clothing versions = 1.2.11.1...

CVE-2026-66909

Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or,...

CVE-2026-66909 Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage

Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or,...

CVE-2026-66909

Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or,...

CVE-2026-66909

The Apache CXF JMS transport component is vulnerable to unsafe deserialization because it processes the body of inbound JMS ObjectMessages using native Java deserialization without any type restrictions. A remote attacker capable of placing a message on the service's JMS destination can submit a ...

EUVD-2026-53854

Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or,...

CVE-2026-71191

A flaw was found in the S3API middleware of OpenStack Swift. The SigV4 presigned URL implementation does not require that semantic x-amz- headers be included in the request signature. An attacker who obtains a presigned PUT URL can inject unsigned headers such as X-Amz-Copy-Source to copy objects...

CVE-2026-64640 Apache Polaris: register endpoint reads attacker-controlled storage location before allowed-locations validation

Apache Polaris did not consistently validate storage locations supplied during table and view registration. An authenticated principal with permission to register a table or view could, depending on the affected release and registration path, cause Polaris to use the catalog's storage credentials...

WordPress ChamaWP plugin < 1.0.13 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin ChamaWP versions 1.0.13...

CVE-2026-14314

The PeproDev WooCommerce Receipt Uploader WordPress plugin (versions

CVE-2026-14313 PeproDev WooCommerce Receipt Uploader <= 2.8.0 - Unauthenticated Order Receipt Tampering via IDOR

PeproDev WooCommerce Receipt Uploader PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 slug: pepro-bacs-receipt-upload-for-woocommerce, all versions up to and including 2.8.0 latest on wordpress.org; no fixed version available at the time of writing, is vulnerable to...