CVE-2026-40758: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Léonie = 1.2.1 versions...

PT-2026-50345

Unauthenticated PHP Object Injection in JetEngine = 3.8.10 versions...

CVE-2026-49108: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Moderno 1.43 versions...

PT-2026-50409

Unauthenticated PHP Object Injection in Moderno 1.43 versions...

PT-2026-50339

Unauthenticated PHP Object Injection in Thrive Apprentice 10.8.10.2 versions...

CVE-2026-49075: Deserialization of Untrusted Data

Contributor PHP Object Injection in JetEngine = 3.8.9.1 versions...

CVE-2026-48759: Authorization Bypass Through User-Controlled Key

TypeBot is a chatbot builder tool. Versions 3.15.2 and below have an Insecure Direct Object Reference vulnerability through cross-workspace Theme Template modification and deletion. The handleSaveThemeTemplate and handleDeleteThemeTemplate handlers validate that the authenticated user is a...

PT-2026-50564

Name of the Vulnerable Software and Affected Versions TypeBot versions prior to 3.16.0 Steeltoe affected versions not specified Description TypeBot contains an Insecure Direct Object Reference IDOR issue—a flaw where an application provides direct access to objects based on user-supplied...

CVE-2026-54806: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in WP Activity Log = 5.6.3.1 versions...

PT-2026-50359

Unauthenticated PHP Object Injection in WP Activity Log = 5.6.3.1 versions...

CVE-2026-40735: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Reina = 2.1 versions...

CVE-2026-40751: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Ashtanga = 1.2 versions...

CVE-2026-40753: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in EasyMeals = 1.5.1 versions...

CVE-2026-42380: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in AI Lab 5.4.2 versions...

PT-2026-50321

Unauthenticated PHP Object Injection in EasyMeals = 1.5.1 versions...

CVE-2026-40725: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in WooCommerce Product Filters 2.0.6 versions...

PT-2026-50396

Unauthenticated PHP Object Injection in Alukas 3.0.0 versions...

CVE-2026-40759: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Esmée = 1.4 versions...

CVE-2026-40739: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in LuxeDrive = 1.4 versions...

CVE-2026-12115: Deserialization of Untrusted Data

The Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.13 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level...