PT-2026-109851

Name of the Vulnerable Software and Affected Versions ShiftCV versions prior to 3.0.15 Description An unauthenticated PHP Object Injection issue exists, which occurs due to the deserialization of untrusted data. This allows an attacker to inject malicious PHP objects into the application...

PT-2026-109888

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the loadDatarule handler of the SysRoleController. This issue allows any authenticated user, including those with low privileges, to query role data rules. By sendin...

PT-2026-109839

Name of the Vulnerable Software and Affected Versions Law Office versions prior to 3.21 Description An unauthenticated PHP Object Injection issue exists, which occurs during the deserialization of untrusted data. This allows an attacker to inject malicious objects into the application without...

CVE-2026-62077: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Avala = 1.1.4 versions...

CVE-2026-62054: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Yacht Rental = 2.6 versions...

CVE-2026-42723: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in CleanSkin = 1.5.0 versions...

CVE-2026-42630: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in Web Plura Backup & Restore Manager = 0.2.25 versions...

CVE-2026-62021: Deserialization of Untrusted Data

Subscriber PHP Object Injection in Angio = 1.1.1 versions...

CVE-2026-42419: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in Swish Migrate and Backup = 1.4.0 versions...

CVE-2026-108579: Improper Neutralization of Formula Elements in a CSV File

OpenPanel through 2.3.0 contains a CSV formula injection vulnerability that allows unauthenticated attackers to embed spreadsheet formulas by supplying crafted profile IDs to the /track endpoint. Attackers can send tracking events with profile IDs like =HYPERLINK... matching a cohort, so exported...

CVE-2026-62044: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in bPlugins Super Video Player super-video-player allows Object Injection.This issue affects Super Video Player: from n/a through 1.8.13...

CVE-2026-104398: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Object Injection.This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a through 1.0.10...

CVE-2026-105885: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in 10Web Slider by 10Web slider-wd allows Object Injection.This issue affects Slider by 10Web: from n/a through 1.2.62...

CVE-2026-97396: Improper Neutralization of Input During Web Page Generation

The Email Marketing for WordPress and WooCommerce – Retainful plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to, and including, 1.0.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticate...

CVE-2026-93937: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ThemeREX Group Hygia hygia allows Object Injection.This issue affects Hygia: from n/a through 1.21.0...

CVE-2026-93933: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ThemeREX Group Rosalinda rosalinda allows Object Injection.This issue affects Rosalinda: from n/a through 1.2.4...

CVE-2026-93931: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ThemeREX Group Smash smash allows Object Injection.This issue affects Smash: from n/a through 1.12.0...

CVE-2026-93930: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ThemeREX Group Tantra tantra allows Object Injection.This issue affects Tantra: from n/a through 2.9.0...

CVE-2026-62046: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ThemeREX Group Gutentype gutentype allows Object Injection.This issue affects Gutentype: from n/a through 2.1.12...

CVE-2026-62045: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers booklovers allows Object Injection.This issue affects Booklovers: from n/a through 2.13.0...