CVE-2026-66565: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in FC United = 1.1.1 versions...

CVE-2026-66563: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Windsor = 2.10 versions...

CVE-2026-108639: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to permanently delete data dictionaries via the deletePhysic handler of SysDictController. Low-privileged attackers can send DELETE requests to /sys/dict/deletePhysic/id to irreversibly remov...

CVE-2026-103365: Exposure of Sensitive Information to an Unauthorized Actor

The Bookly – Online Scheduling and Appointment Booking System plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 28.4 via the classic booking form's Details step. The endpoint booklyrenderdetails is registered for both wpajax and wpajaxnopriv, t...

CVE-2026-93944: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ThemeREX Group Camelia camelia allows Object Injection.This issue affects Camelia: from n/a through 1.2.15...

CVE-2026-93943: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex allows Object Injection.This issue affects Convex: from n/a through 1.16.0...

CVE-2026-93942: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell allows Object Injection.This issue affects Dwell: from n/a through 1.16.0...

CVE-2026-93941: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ThemeREX Group Edema edema allows Object Injection.This issue affects Edema: from n/a through 1.2.2.2...

CVE-2026-93938: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogwords hogwords allows Object Injection.This issue affects Hogwords: from n/a through 1.2.7...

CVE-2026-93936: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ThemeREX Group IPharm ipharm allows Object Injection.This issue affects IPharm: from n/a through 1.2.4...

CVE-2026-93935: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ThemeREX Group Let's Play playhockey allows Object Injection.This issue affects Let's Play: from n/a through 1.1.15...

CVE-2026-93929: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ThemeREX Group Travesia travesia allows Object Injection.This issue affects Travesia: from n/a through 1.1.16...

CVE-2026-93927: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in Axiomthemes Veto veto allows Object Injection.This issue affects Veto: from n/a through 1.6.0...

PT-2026-109850

Name of the Vulnerable Software and Affected Versions Windsor versions 2.10 and earlier Description An unauthenticated PHP Object Injection issue exists, which occurs during the deserialization of untrusted data. This allows an attacker to inject malicious objects into the application without...

PT-2026-109861

Name of the Vulnerable Software and Affected Versions Qwery versions prior to 3.6.2 Description An unauthenticated PHP Object Injection issue exists, which occurs due to the deserialization of untrusted data. This allows an attacker to inject malicious PHP objects into the application...

PT-2026-109852

Name of the Vulnerable Software and Affected Versions FC United versions prior to 1.1.2 Description An unauthenticated PHP Object Injection issue exists, which occurs due to the deserialization of untrusted data. This allows an attacker to inject malicious PHP objects into the application...

PT-2026-109863

Name of the Vulnerable Software and Affected Versions Photolia versions prior to 1.0.4 Description An unauthenticated PHP Object Injection issue exists, which occurs due to the deserialization of untrusted data. This allows an attacker to inject malicious objects into the application without...

PT-2026-109820

Name of the Vulnerable Software and Affected Versions Kalles versions prior to 1.1.7.2 Description An unauthenticated PHP Object Injection issue exists, which occurs due to the deserialization of untrusted data. This allows an attacker to inject malicious objects into the application without...

PT-2026-109576

Name of the Vulnerable Software and Affected Versions Smash versions prior to 1.12.0 Description ThemeREX Group Smash is subject to a deserialization of untrusted data issue that allows Object Injection. Object Injection occurs when untrusted data is used to abuse the logic of an application by...

PT-2026-109571

Name of the Vulnerable Software and Affected Versions Booklovers versions prior to 2.13.0 Description Deserialization of untrusted data in the Booklovers theme allows Object Injection. Object Injection occurs when untrusted data is used to abuse the logic of an application by injecting malicious...