CVE-2026-23544

Deserialization of Untrusted Data vulnerability in codetipi Valenti valenti allows Object Injection.This issue affects Valenti: from n/a through = 5.6.3.5...

CVE-2026-23542

Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Object Injection.This issue affects Grand Restaurant: from n/a through = 7.0.10...

CVE-2026-22333

Deserialization of Untrusted Data vulnerability in YITHEMES YITH WooCommerce Compare yith-woocommerce-compare allows Object Injection.This issue affects YITH WooCommerce Compare: from n/a through = 3.6.0...

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2025-49113link is external RoundCube Webmail Deserialization of Untrusted Data Vulnerability CVE-2025-68461link is external RoundCube Webmail Cross-site Scripti...

Exploit for Deserialization of Untrusted Data in Microsoft

WSUS Security Research Toolkit - Installation Guide System...

WordPress plugin Woocommerce Category Banner Management 代码问题漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There we...

openITCOCKPIT 代码问题漏洞

openITCOCKPIT is an open-source system monitoring software. Versions of openITCOCKPIT 5.3.1 and earlier have code vulnerabilities. These vulnerabilities stem from insecure deserialization points in the Gearman worker implementation, which may lead to PHP object injection attacks...

PT-2026-21065

Name of the Vulnerable Software and Affected Versions BoldThemes Travelicious versions prior to 1.6.7 Description The software contains a flaw due to deserialization of untrusted data, which allows for object injection. This could potentially allow an attacker to manipulate serialized data and...

PT-2026-21143

Name of the Vulnerable Software and Affected Versions Booking and Rental Manager versions through 2.5.9 Description The software contains a flaw due to deserialization of untrusted data, which allows for object injection. This issue impacts the Booking and Rental Manager plugin for WooCommerce...

PT-2026-21163

Name of the Vulnerable Software and Affected Versions Themesflat Elementor versions through 1.0.1 Description A flaw exists in Themesflat Elementor that allows for object injection due to deserialization of untrusted data. This issue could potentially allow for malicious code execution...

PT-2026-21153

Name of the Vulnerable Software and Affected Versions AncoraThemes SevenHills versions through 1.6.2 Description The software contains a flaw due to deserialization of untrusted data, which allows for object injection. Recommendations Update AncoraThemes SevenHills to a version newer than 1.6.2...

openITCOCKPIT 代码问题漏洞

openITCOCKPIT is an open-source system monitoring software. Versions of openITCOCKPIT 5.3.1 and earlier have code vulnerabilities. These vulnerabilities stem from unsafe PHP deserialization patterns when processing change log entries, which may lead to potential PHP object injection vulnerabiliti...

WordPress plugin Nestin 代码问题漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. Versions...

RoundCube Webmail Deserialization of Untrusted Data Vulnerability

RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code execution by authenticated users because the from parameter in a URL is not validated in program/actions/settings/upload.php...

PT-2026-21112

Name of the Vulnerable Software and Affected Versions Kleor Contact Manager versions through 9.1.1 Description A flaw exists in Kleor Contact Manager that allows for object injection due to deserialization of untrusted data. This issue impacts the contact-manager component. Recommendations At the...

PT-2026-21063

Name of the Vulnerable Software and Affected Versions LoftOcean PatioTime versions prior to 2.1 Description A flaw exists in LoftOcean PatioTime that allows for object injection due to deserialization of untrusted data. This issue impacts the application's handling of data, potentially allowing a...

PT-2026-21196

Name of the Vulnerable Software and Affected Versions A WP Life Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery versions through 1.6.0 Description The software contains a flaw related to the deserialization of untrusted data, specifically allowing for object injection...

PT-2026-21201

Name of the Vulnerable Software and Affected Versions Dotstore Woocommerce Category Banner Management versions through 2.5.1 Description The software contains a flaw due to deserialization of untrusted data, which allows for object injection. This issue is present in the Woocommerce Category Bann...

WordPress plugin Booking and Rental Manager 代码问题漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...

WordPress plugin KindlyCare 代码问题漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...