CVE-2026-78175: Deserialization of Untrusted Data

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the withdrawmethodfield parameter of the tutorsavewithdrawaccount AJAX handler. This is due to the handler lacking any capability or role...

Remote Code Execution

laravel/laravel is vulnerable to remote code execution. Improper deserialization in destruct in GuzzleHttp\Cookie\FileCookieJar.php allows an attacker to upload and execute malicious code via an unserialized pop chain...