45821 matches found
CVE-2026-39529: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Elementra = 1.0.9 versions...
CVE-2026-39446: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Kapee 1.7.0 versions...
CVE-2026-39443: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in EmallShop = 2.4.21 versions...
CVE-2026-27429: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Nifty = 1.4.1 versions...
CVE-2026-12256: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ThemeFusion Fusion Builder fusion-builder allows Object Injection.This issue affects Fusion Builder: from n/a through 3.15.3...
CVE-2026-12115: Deserialization of Untrusted Data
The Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.13 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level...
CVE-2025-69122: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in SeaFood Company = 1.4 versions...
CVE-2025-69108: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Hot Coffee = 1.7 versions...
CVE-2025-60205: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ThemeREX Group ThemeREX Addons trxaddons allows Object Injection.This issue affects ThemeREX Addons: from n/a through 2.36.1.1...
PT-2026-50409
Unauthenticated PHP Object Injection in Moderno 1.43 versions...
CVE-2026-49075: Deserialization of Untrusted Data
Contributor PHP Object Injection in JetEngine = 3.8.9.1 versions...
CVE-2026-48759: Authorization Bypass Through User-Controlled Key
TypeBot is a chatbot builder tool. Versions 3.15.2 and below have an Insecure Direct Object Reference vulnerability through cross-workspace Theme Template modification and deletion. The handleSaveThemeTemplate and handleDeleteThemeTemplate handlers validate that the authenticated user is a...
PT-2026-50582
Name of the Vulnerable Software and Affected Versions Drupal Formatter Field versions 0.0.0 through 2.0.0 Description Improperly controlled modification of dynamically-determined object attributes in the Formatter Field module allows for Object Injection. This occurs because the module stores dat...
PT-2026-50395
Unauthenticated PHP Object Injection in PressMart = 1.2.26 versions...
Formatter Field - Critical - PHP object injection - SA-CONTRIB-2026-048
The Formatter Field module provides a mechanism for specifying a formatter and formatter settings to be used for displaying a field, on a per-entity basis. formatterfield stores some data as PHP-serialized strings. In some situations, malicious data can be written directly to the field. This can...
Flag attendance field - Critical - PHP object injection - SA-CONTRIB-2026-049
The Flag attendance field module gives you the ability to add attendance by depending on Flag module. flagattendancefield stores some data as PHP-serialized strings. In some situations, malicious data can be written directly to the field. This can lead to an object injection vulnerability when th...
Plotly.js Graphing - Critical - PHP object injection - SA-CONTRIB-2026-050
The Plotly.js Graphing module provides a fully customizable implementation of the open source Plotly.js graphing library. The module stores some data as PHP-serialized strings. In some situations, malicious data can be written directly to the field. This can lead to an object injection...
Drupal core - Critical - PHP object injection - SA-CORE-2026-005
SA-CORE-2019-003 added protection for fields that store serialized data to disallow direct writes via web services. The above fix did not cover all potential attack vectors for JSON:API. An attacker with appropriate JSON:API write permission could potentially inject a malicious payload in certain...
GHSA-QW24-GH76-8RVV Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix
Summary rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: text /remote:path/object The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during...
