PT-2026-109763

Name of the Vulnerable Software and Affected Versions Web Plura Backup & Restore Manager versions prior to 0.2.26 Description An issue exists that allows unauthenticated users to access sensitive data. Recommendations Update to a version newer than 0.2.25...

CVE-2026-108627: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the loadDatarule handler of SysRoleController that lets any authenticated user query role data rules. Low-privileged attackers can request GET /sys/role/datarule/permissionId/roleId to read rule names, columns, conditions,...

CVE-2026-42419: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in Swish Migrate and Backup = 1.4.0 versions...

CVE-2026-93927: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in Axiomthemes Veto veto allows Object Injection.This issue affects Veto: from n/a through 1.6.0...

CVE-2026-66563: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Windsor = 2.10 versions...

CVE-2026-78529: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Alliance = 3.11 versions...

PT-2026-109762

Name of the Vulnerable Software and Affected Versions Swish Migrate and Backup versions prior to 1.4.1 Description An issue exists that allows unauthenticated users to access sensitive data. Recommendations Update to a version newer than 1.4.0...

PT-2026-109900

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw allows authenticated users to permanently delete data dictionaries. Low-privileged attackers can send DELETE requests to the '/sys/dict/deletePhysic/id' endpoint, which trigge...

PT-2026-109842

Name of the Vulnerable Software and Affected Versions Asia Garden versions 1.3.1 and earlier Description An unauthenticated PHP Object Injection issue exists, which occurs due to the deserialization of untrusted data. This allows an attacker to inject malicious PHP objects into the application...

PT-2026-109810

Name of the Vulnerable Software and Affected Versions Yacht Rental versions 2.6 and earlier Description An unauthenticated PHP Object Injection issue exists, which occurs during the deserialization of untrusted data. This allows an attacker to inject malicious objects into the application without...

PT-2026-109808

Name of the Vulnerable Software and Affected Versions Tipsy versions 1.6 and earlier Description An unauthenticated PHP Object Injection issue exists, which occurs during the deserialization of untrusted data. This allows an attacker to inject malicious PHP objects into the application...

PT-2026-109572

Name of the Vulnerable Software and Affected Versions Gutentype versions prior to 2.1.13 Description Deserialization of untrusted data in the Gutentype plugin allows Object Injection. Object Injection occurs when untrusted data is used to abuse the logic of an application to execute arbitrary cod...

PT-2026-109581

Name of the Vulnerable Software and Affected Versions IPharm versions prior to 1.2.5 Description ThemeREX Group IPharm ipharm contains a deserialization of untrusted data flaw that allows Object Injection. Object Injection occurs when untrusted data is used to abuse the logic of an application by...

PT-2026-109588

Deserialization of Untrusted Data vulnerability in ThemeREX Group Camelia camelia allows Object Injection.This issue affects Camelia: from n/a through 1.2.15...

PT-2026-109576

Name of the Vulnerable Software and Affected Versions Smash versions prior to 1.12.0 Description ThemeREX Group Smash is subject to a deserialization of untrusted data issue that allows Object Injection. Object Injection occurs when untrusted data is used to abuse the logic of an application by...

PT-2026-109573

Name of the Vulnerable Software and Affected Versions Veto versions prior to 1.6.0 Description Deserialization of untrusted data in Veto allows Object Injection, a technique where an attacker can manipulate serialized objects to execute arbitrary code or interfere with application logic...

PT-2026-109574

Name of the Vulnerable Software and Affected Versions Travesia versions prior to 1.1.17 Description Deserialization of untrusted data in the software allows Object Injection, a technique where an attacker can manipulate serialized objects to execute arbitrary code or interfere with application...

PT-2026-109577

Name of the Vulnerable Software and Affected Versions Smart Casa versions prior to 1.0.13 Description ThemeREX Group Smart Casa is subject to a deserialization of untrusted data issue that allows Object Injection. Object Injection occurs when untrusted data is used to abuse the logic of an...

PT-2026-109578

Deserialization of Untrusted Data vulnerability in ThemeREX Group Rosalinda rosalinda allows Object Injection.This issue affects Rosalinda: from n/a through 1.2.4...

PT-2026-109579

Name of the Vulnerable Software and Affected Versions Partiso versions prior to 1.1.14 Description ThemeREX Group Partiso is subject to a deserialization of untrusted data issue that allows Object Injection. Object Injection occurs when untrusted data is used to abuse the logic of an application ...