CVE-2026-112853

Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue affects Hallelujah: from n/a through 1.1.1...

CVE-2026-112852

Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion allows Object Injection.This issue affects Helion: from n/a through 1.1.12...

CVE-2026-112846

Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14...

CVE-2026-112848

Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0...

CVE-2026-112847

Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects ZenSoul: from n/a through 1.13...

CVE-2026-98959

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix xattr replace when multiple xattrs are packed in the same item If we have a btrfsdiritem item that packs multiple xattrs and then we replace the value of one of them with the setxattr2 family of syscalls with another...

CVE-2026-55889

XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileTransfer.RetrieveFiles method to redirect drag-and-drop and copy-paste data targeted at other applications to itself. Some portals generate tokens which provide access to...

UBUNTU-CVE-2026-98975

In the Linux kernel, the following vulnerability has been resolved: xfs: stop exchanging reflink flags when exchanging mappings When an exchange covers both files from offset 0 to idisksize, xmicanexchangereflinkflags assumes every mapping moved and hands the reflink flag over to the other file...

UBUNTU-CVE-2026-98929

In the Linux kernel, the following vulnerability has been resolved: macsec: initialize SecY before registering the netdevice Creating a MACsec device with MAC offload over an LRO-capable lower device triggers a warning in rtmsgifinfobuildskb when IPv4 forwarding is enabled by default...

EUVD-2026-108961

A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite ZCS allows an attacker to inject JavaScript through the packages parameter of the /h/rest document editor. The editor inserts package names into script attributes without HTML encoding. When...

CVE-2026-10632

A reflected cross-site scripting (XSS) vulnerability exists in the Classic Web Client of Zimbra Collaboration Suite (ZCS) . The root cause is the lack of HTML encoding when the document editor inserts package names into script attributes via the /h/rest endpoint's packages parameter. When chained...

CVE-2026-10632 Zimbra Collaboration Suite Classic Web Client Reflected Cross-Site Scripting via Document Editor Packages Parameter

A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite ZCS allows an attacker to inject JavaScript through the packages parameter of the /h/rest document editor. The editor inserts package names into script attributes without HTML encoding. When...

CVE-2026-10632 Zimbra Collaboration Suite Classic Web Client Reflected Cross-Site Scripting via Document Editor Packages Parameter

A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite ZCS allows an attacker to inject JavaScript through the packages parameter of the /h/rest document editor. The editor inserts package names into script attributes without HTML encoding. When...

EUVD-2026-108956

Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0...

CVE-2026-112848

The AivahThemes Hostme v2 WordPress theme (versions

CVE-2026-112848 WordPress Hostme v2 theme <= 7.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0...

CVE-2026-112848 WordPress Hostme v2 theme <= 7.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0...

CVE-2026-112854 WordPress Holistic Center theme <= 1.2.6 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object Injection.This issue affects Holistic Center: from n/a through 1.2.6...

CVE-2026-112847 WordPress ZenSoul theme <= 1.13 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects ZenSoul: from n/a through 1.13...

CVE-2026-112847

The ThemeREX ZenSoul WordPress theme (versions $\le$ 1.13 ) is vulnerable to a PHP Object Injection flaw caused by the deserialization of untrusted data . This vulnerability allows an attacker to inject objects into the application, potentially leading to arbitrary code execution or other severe ...