Elasticsearch 8.x < 8.19.20 / 9.0.x < 9.4.5 / 9.5.x < 9.5.1 RCE (ESA-2026-114)

The version of Elasticsearch installed on the remote host is 8.x prior to 8.19.20, or 9.0.x prior to 9.4.5, or 9.5.x prior to 9.5.1. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-114 advisory. - Deserialization of Untrusted Data CWE-502 in the Elasticsearch machine...

Exploit for CVE-2026-82222

⚡ GHOSTLYR00T - GiveWP RCE Exploit Framework...

Exploit for Deserialization of Untrusted Data in Devcode Openstamanager

CVE-2026-29782 — OpenSTAManager auth-SQLi → PHP object injecti...

Security Bulletin: Multiple vulnerabilities found in CICS Transaction Gateway Desktop Edition.

Summary Multiple vulnerabilities were identified in third-party components used by CICS Transaction Gateway Desktop Edition, including IBM WebSphere Application Server, IBM WebSphere Application Server Liberty, Apache Tomcat Embed, Logback Classic, Log4j API, and Jackson Databind. To address thes...

WordPress Ninja Forms – The Contact Form Builder That Grows With You plugin <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection vulnerability

Authenticated Administrator+ PHP Object Injection vulnerability discovered by Hermione in WordPress Plugin Ninja Forms versions = 3.14.6...

CVE-2026-16502

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to injec...

EUVD-2026-72695

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to injec...

CVE-2026-16502 Live Composer <= 2.1.18 - Authenticated (Contributor+) PHP Object Injection via Shortcode

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to injec...

CVE-2026-16502

The Live Composer – Free WordPress Website Builder plugin (versions ≤ 2.1.18) is vulnerable to PHP Object Injection via deserialization of untrusted input introduced through a shortcode. Authenticated attackers with contributor-level access or above can inject a PHP object. Critically, no known P...

CVE-2026-16502 Live Composer <= 2.1.18 - Authenticated (Contributor+) PHP Object Injection via Shortcode

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to injec...

WordPress Wise Chat plugin <= 3.4.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Peng Zhou in WordPress Plugin Wise Chat versions = 3.4.1...

PT-2026-87027

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to injec...

CVE-2026-16502: Deserialization of Untrusted Data

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to injec...

WordPress Folders plugin <= 3.1.9 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by daroo in WordPress Plugin Folders versions = 3.1.9...

WordPress Live Composer – Free WordPress Website Builder plugin <= 2.1.18 - Authenticated (Contributor+) PHP Object Injection vulnerability

Authenticated Contributor+ PHP Object Injection vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Page Builder: Live Composer versions = 2.1.18...

CVE-2026-10196

The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.31.0 via deserialization of untrusted input in the 'handleformsubmission' function. This makes it possible for...

CVE-2026-10196 Mail Mint <= 1.31.0 - Unauthenticated PHP Object Injection in Arbitrary Form Fields

The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.31.0 via deserialization of untrusted input in the 'handleformsubmission' function. This makes it possible for...

CVE-2026-10196 Mail Mint <= 1.31.0 - Unauthenticated PHP Object Injection in Arbitrary Form Fields

The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.31.0 via deserialization of untrusted input in the 'handleformsubmission' function. This makes it possible for...

EUVD-2026-71991

The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.31.0 via deserialization of untrusted input in the 'handleformsubmission' function. This makes it possible for...

CVE-2026-10196

The Mail Mint WordPress plugin (Email Marketing, Newsletter, Email Automation & WooCommerce Emails) is affected by an unauthenticated PHP Object Injection in all versions up to and including 1.31.0 . The root cause is deserialization of untrusted input in the handle_form_submission function, whic...