CVE-2025-60205: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ThemeREX Group ThemeREX Addons trxaddons allows Object Injection.This issue affects ThemeREX Addons: from n/a through 2.36.1.1...

PT-2026-50302

Unauthenticated PHP Object Injection in Zermatt = 1.6.1 versions...

CVE-2026-39545: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Zermatt = 1.6.1 versions...

CVE-2026-40738: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Eldon = 1.4.1 versions...

CVE-2026-40733: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in ShiftUp = 1.3 versions...

PT-2026-50404

Name of the Vulnerable Software and Affected Versions ShiftUp versions 1.3 and earlier Description An unauthenticated PHP Object Injection issue exists in the software. PHP Object Injection occurs when user-supplied input is passed to the unserialize function without proper validation, potentiall...

CVE-2026-40761: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Valeska = 1.2.2 versions...

CVE-2026-40756: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Zoya = 1.4 versions...

CVE-2026-40757: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Château = 1.2.1 versions...

PT-2026-50408

Unauthenticated PHP Object Injection in Château = 1.2.1 versions...

PT-2026-50407

Unauthenticated PHP Object Injection in Zoya = 1.4 versions...

CVE-2026-40755: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in TechLink = 1.3 versions...

CVE-2026-40759: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Esmée = 1.4 versions...

CVE-2026-40758: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Léonie = 1.2.1 versions...

PT-2026-50345

Unauthenticated PHP Object Injection in JetEngine = 3.8.10 versions...

CVE-2026-49108: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Moderno 1.43 versions...

PT-2026-50409

Unauthenticated PHP Object Injection in Moderno 1.43 versions...

PT-2026-50339

Unauthenticated PHP Object Injection in Thrive Apprentice 10.8.10.2 versions...

CVE-2026-49075: Deserialization of Untrusted Data

Contributor PHP Object Injection in JetEngine = 3.8.9.1 versions...

CVE-2026-48759: Authorization Bypass Through User-Controlled Key

TypeBot is a chatbot builder tool. Versions 3.15.2 and below have an Insecure Direct Object Reference vulnerability through cross-workspace Theme Template modification and deletion. The handleSaveThemeTemplate and handleDeleteThemeTemplate handlers validate that the authenticated user is a...