CVE-2026-32563 WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...

CVE-2026-32563

CVE-2026-32563 is a PHP Object Injection vulnerability in the ACPT (Pro) – Custom Post Types Plugin for WordPress , affecting versions ≤ 2.0.63 . The vulnerability requires Subscriber -level access as stated in the description, though the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) rates Pr...

CVE-2026-32563 WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...

CVE-2026-40877

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to PHP object injection in the user preference functionality, which can lead to remote code execution. This issue has been fixed in version 3.2.3...

CVE-2026-40877 Combodo iTop: PHP Object Injection Leading to Remote Code Execution on user preferences

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to PHP object injection in the user preference functionality, which can lead to remote code execution. This issue has been fixed in version 3.2.3...

CVE-2026-40877 Combodo iTop: PHP Object Injection Leading to Remote Code Execution on user preferences

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to PHP object injection in the user preference functionality, which can lead to remote code execution. This issue has been fixed in version 3.2.3...

CVE-2026-40877

Combodo iTop , a web-based IT service management tool, is vulnerable to PHP object injection in its user preference functionality prior to version 3.2.3 , which can lead to remote code execution . The attack vector is network-based with low complexity and requires low privileges and user interact...

WordPress WP Project Manager plugin <= 4.0.6 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by 20kilograma in WordPress Plugin WP Project Manager versions = 4.0.6...

CVE-2026-66650

Unauthenticated PHP Object Injection in FreightCo = 1.1.15 versions...

CVE-2026-66650 WordPress FreightCo theme <= 1.1.15 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in FreightCo = 1.1.15 versions...

EUVD-2026-64809

Unauthenticated PHP Object Injection in FreightCo = 1.1.15 versions...

CVE-2026-66650

CVE-2026-66650 is an unauthenticated PHP Object Injection vulnerability in the WordPress theme FreightCo , affecting versions ≤ 1.1.15 . Discovered by daroo , it allows a remote, unauthenticated attacker to achieve full compromise (confidentiality, integrity, and availability), rated CVSS 9.8 (CR...

Astra Linux – Vulnerability in libxstream-java

XStream is a Java library for serializing objects to XML and back again. In XStream before version 1.4.16, there was a vulnerability where the processed stream at unmarshalling time contained type information that allowed new instances to be created based on those type information. An attacker...

PT-2026-81052

Name of the Vulnerable Software and Affected Versions ACPT Pro - Custom Post Types Plugin for WordPress versions 2.0.63 and earlier Description PHP Object Injection occurs when an application deserializes untrusted data, allowing an attacker to manipulate the resulting object and potentially...

PT-2026-80842

Unauthenticated PHP Object Injection in FreightCo = 1.1.15 versions...

PT-2026-81058

Name of the Vulnerable Software and Affected Versions The Events Calendar versions prior to 6.17.3 Description An unauthenticated PHP Object Injection issue exists. PHP Object Injection occurs when untrusted input is passed to the PHP unserialize function, potentially allowing an attacker to...

PT-2026-80997

Name of the Vulnerable Software and Affected Versions Combodo iTop versions prior to 3.2.3 Description Combodo iTop is a web-based IT service management tool. The user preference functionality is susceptible to PHP object injection, a condition where untrusted input is passed to the PHP unseriali...

EUVD-2026-64607

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.18 via deserialization of untrusted input from the 'postprotectionroles' vulnerable parameter. This makes it possible for authenticated attackers, with...

CVE-2026-0551

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.18 via deserialization of untrusted input from the 'postprotectionroles' vulnerable parameter. This makes it possible for authenticated attackers, with...

WordPress PPWP – Password Protect Pages plugin <= 1.9.18 - Authenticated (Contributor+) PHP Object Injection vulnerability

Authenticated Contributor+ PHP Object Injection vulnerability discovered by Webbernaut in WordPress Plugin PPWP versions = 1.9.18...