CVE-2026-62090: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in WineShop = 3.20 versions...

CVE-2026-62043: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extension = 5.0.7 versions...

CVE-2026-108629: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartPermissionController that allows any authenticated user to modify department data rules. Low-privileged attackers can send departId, permissionId and dataRuleIds to POST...

CVE-2026-108627: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the loadDatarule handler of SysRoleController that lets any authenticated user query role data rules. Low-privileged attackers can request GET /sys/role/datarule/permissionId/roleId to read rule names, columns, conditions,...

CVE-2026-78535: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Photolia = 1.0.3 versions...

CVE-2026-78533: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Qwery = 3.6.1 versions...

CVE-2026-78531: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Jacqueline = 2.22 versions...

CVE-2026-78529: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Alliance = 3.11 versions...

CVE-2026-66567: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Anesta = 1.5.3 versions...

CVE-2026-66565: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in FC United = 1.1.1 versions...

CVE-2026-66563: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Windsor = 2.10 versions...

CVE-2026-108639: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to permanently delete data dictionaries via the deletePhysic handler of SysDictController. Low-privileged attackers can send DELETE requests to /sys/dict/deletePhysic/id to irreversibly remov...

CVE-2026-103365: Exposure of Sensitive Information to an Unauthorized Actor

The Bookly – Online Scheduling and Appointment Booking System plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 28.4 via the classic booking form's Details step. The endpoint booklyrenderdetails is registered for both wpajax and wpajaxnopriv, t...

CVE-2026-93944: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ThemeREX Group Camelia camelia allows Object Injection.This issue affects Camelia: from n/a through 1.2.15...

CVE-2026-93943: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex allows Object Injection.This issue affects Convex: from n/a through 1.16.0...

CVE-2026-93942: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell allows Object Injection.This issue affects Dwell: from n/a through 1.16.0...

CVE-2026-93941: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ThemeREX Group Edema edema allows Object Injection.This issue affects Edema: from n/a through 1.2.2.2...

CVE-2026-93938: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogwords hogwords allows Object Injection.This issue affects Hogwords: from n/a through 1.2.7...

CVE-2026-93936: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ThemeREX Group IPharm ipharm allows Object Injection.This issue affects IPharm: from n/a through 1.2.4...

CVE-2026-93935: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ThemeREX Group Let's Play playhockey allows Object Injection.This issue affects Let's Play: from n/a through 1.1.15...